Bitcoin Wallet Fixes Critical Flaw That Redirected Funds to Attackers

What it is

Electrum, the Bitcoin software wallet, has a high-severity flaw in every version before 4.8.3. A rogue Electrum server can suppress a user's real payment and show a fake conflicting unconfirmed transaction that pays an attacker. Developer SomberNight published the advisory. The page does not give a CVE id.

How it works

Electrum does not verify signatures on unconfirmed transactions that a server sends it. The attack runs in four steps:

1. The user broadcasts a payment through a compromised server.
2. The server withholds the real transaction and injects a fake one with the attacker's output address and zero fee. The payment looks stuck.
3. The user fee-bumps the apparently stalled payment. Electrum signs and broadcasts a new valid transaction that pays the attacker.
4. That fee-bump is the first transaction to reach the network. The real payment was never sent.

The advisory adds that attackers can grind the fake output address to match the last four characters of the intended destination. A user who checks only the tail of the address would see a match.

Preconditions / Affected

• All Electrum versions before 4.8.3.
• The wallet is connected to a malicious server. Anyone can run an Electrum server.
• Users who connect only to a server they run themselves are not affected.
• The advisory says "some servers are performing this attack in the wild." Two user reports back this. On 11 October 2026 dannydeezy flagged suspicious server behavior, and the fake transaction never propagated past the local server, so nothing was lost. On 18 October 2026 Raju-K12 reported a confirmed loss after fee-bumping a manipulated transaction.

What to do

Update to Electrum 4.8.3, available from electrum.org and the project's GitHub. The fix was tagged in the repository on 23 October 2026 and binaries followed on 24 October.

If you cannot update at once, check the full output address and amount before signing any transaction, and especially before any fee-bump. Do not compare only the end of the address. Alternatively, connect only to a server you run yourself.

Caveats

• 4.8.3 verifies signatures on wallet-owned inputs before an unconfirmed transaction enters local history. A server can no longer inject a fake transaction that touches the user's own addresses.
• Incoming transactions from external senders, where none of the inputs belong to the wallet, are still accepted without signature verification. SomberNight acknowledged this gap and said closing it needs more work. The page does not say what an attacker could do with that gap.
• The page cites two user reports. It gives no count of affected users or total losses.
• The page notes an earlier incident: a 2018 campaign used rogue servers to push fake update notifications, and an estimated $25 million was drained by 2020. It does not say how that relates to this flaw.