Electrum has released a security update after a high-severity vulnerability allowed malicious servers to replace apparent pending Bitcoin payments with fake transactions directing funds to attacker-controlled addresses. The wallet project’s version 4.8.3, published on October 24, patches the main weakness. At least one user has confirmed losing money in the attack.
How the attack worked
The vulnerability was tied to Electrum’s handling of unconfirmed transactions. Electrum is a long-established Bitcoin software wallet that relies on servers to help broadcast transactions and provide wallet information. Its open server model means that anyone can operate a server, creating the possibility that users may connect to a hostile one.
According to Decrypt, a malicious server could suppress a user’s genuine payment and insert a conflicting transaction into the wallet’s local history. The counterfeit transaction could display an address controlled by the attacker and no transaction fee, making it appear that the original payment was simply delayed or stuck.
The danger emerged when a user attempted to accelerate the apparently stalled payment by using Bitcoin’s fee-bumping process. Instead of speeding up the intended transfer, the user would sign and broadcast a new, valid transaction whose destination address belonged to the attacker. The fake transaction was not the payment that ultimately reached the network; the fee-bumped transaction was the first one to do so, and it transferred the funds to the attacker.
The exploit could also make a quick visual check less reliable. Electrum developer SomberNight said attackers could repeatedly generate an output address whose final four characters matched the intended recipient’s address. A user checking only those last characters might therefore overlook the substitution.
Reports and Electrum’s response
The project’s advisory said some servers were carrying out the attack in the wild and referred to two user reports. One user, identified as dannydeezy, raised concerns about suspicious server activity on October 11. In that case, the manipulated transaction did not move beyond the local server, so no funds were lost.
A second user, identified as Raju-K12, reported a confirmed loss on October 18 after fee-bumping a transaction that had been manipulated by a server. The report provides at least one confirmed example of money being stolen through the vulnerability.
Electrum released version 4.8.3 on October 24, following a repository tag on October 23. The update changes how the wallet treats unconfirmed transactions that involve addresses owned by the user. Before such a transaction is added to the wallet’s local history, the software now checks the cryptographic signatures on the wallet-owned inputs.
That check is intended to prevent a server from fabricating a transaction involving the user’s own addresses. Without the relevant private keys, an attacker cannot create the signatures needed for the fake transaction to pass this verification.
The update does not verify every type of incoming transaction. When a transaction comes from an external sender and none of its inputs belong to the user’s wallet, Electrum still accepts it without signature verification. SomberNight acknowledged that closing this remaining gap would require additional work.
Background and current Bitcoin market picture
The incident follows earlier attacks involving Electrum. In 2018, rogue servers were used to distribute fake software-update notifications. By 2020, that campaign had drained an estimated $25 million from Electrum users. The wallet’s open server structure, which allows anyone to run a server, is a central factor in this type of risk.
Users who connect only to a server they operate themselves are not affected by this particular attack, according to the project’s advisory. Electrum 4.8.3 is available through electrum.org and the project’s GitHub repository. The advisory also says that users unable to update immediately should manually check destination addresses and payment amounts before signing a transaction.
Moneyiar market data recorded at 22:39 on October 25, 2026, put Bitcoin at $80,430.51. BTC was down 0.08% over 24 hours and 1.32% over seven days. Other assets tracked by Moneyiar at approximately the same time were:
- Plasma (XPL): $0.0738233787, up 0.12% in 24 hours and down 2.89% over seven days.
- Walrus (WAL): $0.0343190471, down 0.30% in 24 hours and 11.97% over seven days.
- FUNToken (FUN): $0.0089182414, up 1.62% in 24 hours and 0.08% over seven days.
The Electrum disclosure concerns wallet security and transaction verification rather than a change to Bitcoin’s network rules. Its immediate significance is that a payment displayed inside a wallet may not be trustworthy when it is still unconfirmed and information is coming from a potentially compromised server.
