Electrum has patched a high-severity flaw that let malicious servers redirect Bitcoin payments when users raised fees. The developers confirmed active exploitation and at least one user's loss. Funds were taken without compromising private keys.
Electrum released version 4.8.3 to fix a flaw that allowed hackers to redirect payments when users tried to increase a transaction fee. The developers disclosed the vulnerability on Oct. 24, confirming that malicious servers had exploited it and that at least one user lost Bitcoin after approving a fraudulent transaction.
The disclosure followed two complaints received on Oct. 11 and Oct. 18. Both incidents involved attackers generating addresses that matched the final four characters of the intended recipients' addresses. Electrum did not disclose the amount stolen.
How a fee increase became a theft mechanism
The flaw affects Electrum versions earlier than 4.8.3 and stems from the wallet's reliance on external servers to track unconfirmed transactions. A malicious server can withhold a user's payment from the network and supply a conflicting version that redirects the funds to an attacker-controlled address.
That substitute transaction initially carries invalid signatures. However, affected clients failed to verify them before showing it in the wallet's unconfirmed history, so the legitimate payment disappears from view.
The attacker then relies on Replace-by-Fee. If the victim manually raises the fee, Electrum generates fresh signatures that authorize the altered payment details, and the funds move without exposing the user's private keys. In the Oct. 18 incident, the attackers reportedly set the fee to zero, potentially encouraging the victim to raise it.
What the patch changes
Version 4.8.3 adds signature checks for wallet-owned inputs before unconfirmed transactions enter the client's local history. The developers tagged the release on Oct. 23 and distributed it on Oct. 24.
They advised users to download the patch from Electrum's official website and to verify complete recipient addresses and payment amounts when signing. According to the advisory, clients connected only to trusted servers, including privately operated ones, are not exposed. The patch does not extend signature verification to every incoming transaction.
Source: CryptoSlate
Trading involves risk.
Risk Disclaimer
