Bitcoin wallet Electrum released version 4.8.3 on October 24 with a patch for a high-severity exploit that allowed malicious servers to inject fake transactions and trick users into paying attacker-controlled addresses.

The flaw affects all versions of the wallet prior to 4.8.3, which is now available. At least one user has confirmed losing funds to the exploit.

How the attack works

According to a security advisory published by Electrum developer SomberNight, the attack exploits the wallet's trust model for unconfirmed transactions. When a user broadcasts a payment through a compromised server, the server can suppress the real transaction and inject a fake, conflicting one—displaying an attacker's output address and a zero fee, which makes the payment appear stuck.

Because Electrum does not verify signatures on unconfirmed transactions received from its server, the spoofed transaction shows up in the wallet's history as legitimate. When the user fee-bumps what looks like a stalled payment, they sign and broadcast an entirely new, valid transaction—one whose output address belongs to the attacker. The original payment was never sent; the fee-bump is the first transaction that actually reaches the network, and it pays the attacker.

Fee-bumping itself is a routine Bitcoin practice—a standard way to nudge a payment that appears stuck—so the spoof turns an everyday troubleshooting step into the moment funds are redirected. The zero fee displayed on the fake transaction is what creates the impression of a stalled payment in the first place.

SomberNight noted that attackers can grind the fake transaction's output address so that it matches the last four characters of the user's intended destination. Anyone who spot-checks only the tail of a long Bitcoin address would see an apparent match.

Attack confirmed in the wild

The advisory states that "some servers are performing this attack in the wild," backed by two user reports. A user identified as dannydeezy first flagged the suspicious server behavior on October 11; the manipulated transaction never propagated past the local server, so no funds were lost. A second user, Raju-K12, reported a confirmed loss on October 18 after fee-bumping a manipulated transaction.

What the patch changes

The fix in 4.8.3 closes the main attack surface by verifying cryptographic signatures on wallet-owned inputs before adding any unconfirmed transaction to local history. A server can no longer inject a fake transaction touching the user's own addresses without providing valid signatures—which an attacker cannot forge. The fix was tagged in the repository on October 23, and binaries were published the following day on the official release page.

Incoming transactions from external senders—where none of the inputs belong to the user's wallet—are still accepted without signature verification. SomberNight acknowledged this remaining gap in the advisory, noting that closing it would require additional work. How and when Electrum extends that verification to externally sourced transactions is the main open item to watch in future releases.

A familiar target

Electrum, one of the oldest Bitcoin software wallets, has dealt with malicious campaigns before. An attack that began in 2018 used rogue servers to push fake update notifications, and by 2020 it had drained an estimated $25 million from Electrum users.

The wallet's open server model—anyone can run a node—is what makes this class of attack possible. Electrum is a lightweight client that relies on external servers for blockchain data rather than downloading the full chain, a trade-off that keeps the wallet fast but places its security in a server-facing trust model that this exploit targeted directly. Users who connect exclusively to a server they run themselves are not affected.

Anyone still running a version before 4.8.3 remains exposed, and anyone who cannot update immediately should manually verify output addresses and amounts before signing any transaction. Electrum 4.8.3 is available at electrum.org alongside the project's GitHub repository.