Malicious Electrum servers have been replacing users' just-broadcast bitcoin payments with fake zero-fee transactions that pay lookalike addresses, betting that victims would raise the fee and sign the attacker's version. Electrum released version 4.8.3 on October 24 to address the high-severity flaw. Maintainer SomberNight published advisory GHSA-6jp4-8v48-cc5v the same day and asked users to upgrade.

How the attack works

Electrum is a light client: it does not run a full bitcoin node and relies on its server for information about unconfirmed mempool transactions, as the project's own documentation explains. When a user signs and sends a transaction (tx1), a bad server can stop it and hand the wallet a different transaction (tx2) that sends the money to an attacker's address.

Tx2 carries invalid signatures. Older versions of Electrum did not verify the signatures of mempool transactions, so the wallet displayed tx2 as pending and hid tx1. Replace-By-Fee (RBF) permits a sender to rebroadcast an unconfirmed transaction with a higher fee. If the fee on the fake is increased, the wallet signs the attacker's version with a valid signature. That turns a routine step — bumping the fee on a payment that seems stuck — into the moment the victim's own wallet signs the attacker's transaction.

Forged address shared a GyQ3 ending with the legitimate destination

One of the targets, known as dannydeezy, documented the attack. The setup was a 2-of-3 legacy P2SH multisig with two Trezors, 31 inputs, and one output. The user checked the output on both Trezors and then broadcast. The Trezors verified the genuine transaction before it left the wallet; the attacker's version only appeared afterward, handed over by the malicious server, so the on-device checks never saw it. Wallet history then displayed the full amount going to an unknown address as unconfirmed, and the entry later flipped to "Local." In Electrum, "Local" marks a transaction known only to the wallet and not visible on the network.

The fake replicated the real transaction's inputs, version, and locktime, with byte-identical scriptSigs on all 31 inputs. All 62 of the signatures checked out against the real transaction; none checked out against the fake. Almost all of the funds went to a lookalike address, with a small amount sent back to one of the wallet's own used addresses.

The fake ended in GyQ3 — and so did the real destination. The attacker had figured out an address matching the last four characters of the correct address. ZachXBT has also called out a similar address-poisoning scam affecting Phantom wallet users; spoofed addresses are designed to defeat a glance at the first and last characters.

Version 4.8.3 checks signatures only on wallet-owned inputs

Another user, Raju-K12, privately reported on Oct. 18 that they bumped the fee on the fake and lost money. According to the maintainers, some servers are running the attack in the wild.

Commit 90fe308 adds a check for signatures on wallet-owned "is_mine" inputs before adding a mempool transaction to local history. Version 4.8.3 was git-tagged on October 23, and binaries were released the next day.

Electrum still checks only inputs the wallet controls, so unconfirmed incoming transactions go unchecked, because the client has no full script interpreter. For recipients, that means a pending incoming payment cannot be fully verified by the wallet alone until it confirms on the blockchain. Electrum's workaround for anyone who cannot upgrade is to verify output addresses and amounts before signing anything, including fee bumps. Users who connected only to their own servers were never affected.

Electrum has shipped emergency fixes in the past. In January 2018, it closed down a JSON RPC interface that had been left open for some two years, after Google researcher Tavis Ormandy found that a website could detect port and drain funds. Cryptopolitan reported that a Coldcard seed-generation bug warning came in July, the same day approximately 594 BTC — about $38 million — was drained from roughly 500 wallets.