A security flaw in the Electrum Bitcoin wallet allowed malicious servers to replace legitimate unconfirmed transactions with fake payments, potentially directing users’ coins to attacker-controlled addresses when they tried to increase transaction fees. At least one user lost bitcoin before the issue was patched.
How the attack worked
Electrum is a long-standing Bitcoin software wallet, but unlike a full Bitcoin node it depends on external servers to retrieve transaction histories and broadcast payments. The vulnerability arose because earlier versions accepted information about pending transactions from those servers without checking the transactions’ signatures.
A server controlled by an attacker could intercept a payment before it was confirmed on the Bitcoin network and present Electrum with a substitute transaction. The replacement appeared in the wallet’s transaction history as a pending payment, even though it used invalid signatures and sent the funds to an address controlled by the attacker.
The risk became more serious when users attempted to accelerate the payment. Bitcoin’s Replace-by-Fee, or RBF, feature allows an unconfirmed transaction to be replaced with another transaction carrying a higher fee. In the vulnerable version of Electrum, selecting that option could cause the wallet to take the fraudulent pending transaction and create a valid replacement signed by the user. That action effectively authorized the transfer to the attacker.
In one reported incident, the substituted transaction carried no fee, which could make it appear to be stuck and encourage the user to raise the fee. The attackers also created recipient addresses ending in the same four characters as the legitimate destination, making a quick visual comparison less likely to reveal the substitution.
Reports and Electrum’s response
According to CoinDesk, Electrum’s developers received two reports in October and said some servers were already exploiting the weakness. The first report, submitted on Oct. 11, involved a two-of-three multisignature wallet that used two Trezor hardware devices. The user checked the legitimate payment on both devices, but later found a different outgoing transaction in the wallet history. That user did not report losing funds.
A second report arrived on Oct. 18. In that case, the user increased the fee on a substituted transaction and lost bitcoin. Electrum confirmed the theft but did not disclose the amount taken or identify the malicious servers involved.
Electrum released version 4.8.3 on Oct. 24. The update adds signature verification for relevant unconfirmed transactions that spend coins from the user’s own wallet. This check is intended to stop the wallet from accepting the kind of invalid replacement used in the attack.
Earlier Electrum versions remain vulnerable when they connect to malicious servers. The developers therefore recommend that users upgrade their wallets and carefully check both the receiving address and the payment amount before signing a transaction. Users who connected only to trusted servers, including servers they operated themselves, were not exposed to this particular attack.
The timing of the response is notable: the fix was released six days after the first reported theft. The incident also illustrates why a transaction displayed as pending in a wallet should not automatically be treated as authentic. In this case, the problem was not simply a higher fee or a delayed confirmation; a malicious server had supplied the wallet with a different transaction.
Bitcoin market picture
Moneyiar market data recorded Bitcoin at $80,430.506808014 at 22:39 on Oct. 25, 2026. The cryptocurrency was down 0.08% over 24 hours and 1.32% over seven days.
Other assets in the same Moneyiar data set showed mixed performance:
- AKEDO (AKE) was priced at $0.031015752, up 0.8% over 24 hours and 2.5% over seven days.
- Velo (VELO) was priced at $0.0038151074, down 0.47% over 24 hours and 6.02% over seven days.
- Walrus (WAL) was priced at $0.0343190471, down 0.3% over 24 hours and 11.97% over seven days.
These figures are Moneyiar market data at the stated times and are separate from the Electrum security disclosure.
