Electrum has released a security update after discovering that attackers could redirect certain pending Bitcoin payments when users tried to increase transaction fees. The vulnerability allowed malicious servers to replace transaction details shown in affected wallets, potentially leading users to authorize payments to attacker-controlled addresses without exposing their private keys.
According to CryptoSlate, Electrum’s developers disclosed the issue on October 24 after confirming that malicious servers had actively exploited it. At least one user lost Bitcoin after unknowingly approving a fraudulent transaction, although Electrum has not said how much was stolen or how many wallets may have been affected.
The flaw affects Electrum versions released before 4.8.3. Users have been urged to install version 4.8.3 from the wallet’s official website and to check complete recipient addresses and payment amounts before signing transactions.
How the attack worked
The vulnerability involved the way Electrum handled information supplied by external servers while tracking unconfirmed Bitcoin transactions. After a user broadcast a payment, a malicious server could withhold the genuine transaction from the network and provide a conflicting version that sent the funds to an address controlled by the attacker.
The substituted transaction initially contained invalid signatures and therefore could not be processed as a valid payment. However, affected Electrum clients did not verify those signatures before displaying the replacement in the wallet’s unconfirmed transaction history. The legitimate payment then disappeared from that view, while the fraudulent version appeared to be waiting for confirmation.
The attackers could take advantage of Bitcoin’s Replace-by-Fee, or RBF, mechanism. RBF allows a user to increase the fee attached to a delayed transaction in an effort to encourage miners to confirm it more quickly. If a victim manually raised the fee on the substituted transaction, the wallet generated new signatures for the altered payment information. That action made the attacker-directed transaction valid and allowed the Bitcoin to be transferred.
In the incident reported on October 18, the fraudulent transaction carried a zero fee, which could have encouraged the victim to increase it. The attack therefore did not require the hackers to obtain the victim’s private keys. Instead, it relied on manipulating the transaction displayed by the wallet and getting the user to approve the revised details.
Address lookalikes increased the deception risk
Both reported incidents also involved Bitcoin addresses designed to share the final four characters of the intended recipients’ addresses. That tactic could mislead users who checked only a shortened portion of an address before signing.
Electrum said it received complaints on October 11 and October 18. In the first case, a user noticed an unfamiliar transaction in the wallet after broadcasting a payment. In the second, a user reported losing funds while attempting to accelerate a pending transfer.
The incidents highlight the importance of checking the full destination address and the payment amount, rather than relying on only the last few characters. Bitcoin addresses are long strings, and a partial visual match does not establish that the recipient is the intended one.
Electrum’s response and current market picture
Electrum tagged version 4.8.3 on October 23 and distributed the updated software on October 24, alongside its public security disclosure. The release adds checks of signatures for wallet-owned inputs before unconfirmed transactions are placed in the client’s local history. This is intended to stop the reported replacement from advancing to the fee-adjustment stage.
The developers said clients connected exclusively to trusted servers, including privately operated servers, were not exposed to this attack. They also noted that the patch does not add signature verification for every incoming transaction. Electrum did not disclose the total amount stolen, and the number of compromised wallets remains unresolved.
Moneyiar market data recorded at 22:39 on October 25, 2026, showed Bitcoin at $80,430.506808014, down 0.08% over 24 hours and 1.32% over seven days. Other listed assets showed mixed performance: Nexus was priced at $0.0000006151, up 1.61% in 24 hours but down 13.97% over seven days; Propy stood at $0.3318772943, up 1.70% over 24 hours and down 3.95% over seven days; and TAC Protocol was $0.0065984417, up 69.35% over 24 hours and 166.36% over seven days, according to Moneyiar data recorded at 09:53 on August 27, 2026.
The Electrum incident underscores that transaction security depends not only on protecting private keys, but also on verifying the information a wallet presents before a user authorizes a payment. For affected users, upgrading the software and reviewing complete transaction details are the measures specified in the developers’ advisory.
