Bitcoin wallet Electrum has issued an emergency security update after attackers exploited a flaw that allowed malicious servers to swap legitimate transactions for fraudulent ones, deceiving users into sending Bitcoin to attacker-controlled addresses.

The high-severity vulnerability, disclosed on October 24, 2026 in a security advisory, affects all Electrum versions before 4.8.3. Developers confirmed the attack was exploited in the wild: two users reported incidents, and at least one lost funds after attempting to raise a transaction fee.

The exploit did not require access to keys or recovery phrases. Instead, attackers manipulated unconfirmed transactions shown inside the wallet, taking advantage of Electrum's reliance on external servers for transaction information.

Malicious Servers Substituted Legitimate Transactions

Electrum operates as a lightweight Bitcoin wallet: rather than maintaining a complete blockchain node, it retrieves transaction histories and broadcasts payments through external servers.

The flaw let a malicious server intercept a newly broadcast Bitcoin transaction and prevent it from reaching the network. The server could then replace the legitimate payment in the user's wallet history with a fraudulent version directing funds to an attacker-controlled address.

Although the substituted transaction carried invalid cryptographic signatures, vulnerable Electrum versions displayed it as an ordinary unconfirmed payment.

The scheme became effective when users tried to raise fees through Bitcoin's Replace-by-Fee (RBF) mechanism. Electrum could use the fraudulent transaction as the basis for the replacement, prompting the user to authorize a valid payment that transferred funds to the attacker.

In both reported cases, the attackers generated destination addresses matching the final four characters of the intended recipient's Bitcoin address, making the substitution harder to detect. One fraudulent transaction also carried virtually no transaction fee, potentially encouraging the victim to use the fee-increase function.

Two Users Report Attacks, Including One Confirmed Theft

The first incident reached Electrum's developers on October 11 and involved a two-of-three multisignature wallet connected to two Trezor hardware devices. The user had verified a legitimate outgoing Bitcoin transaction on both devices before broadcasting it, yet the wallet subsequently displayed an unfamiliar transaction sending the funds to a different address.

Investigators established that the original transaction never reached Bitcoin's mempool. The fraudulent replacement reused the same inputs but altered the destination, and its signatures were invalid for the substituted payment. That user identified the discrepancy before suffering any reported loss.

A second user contacted developers on October 18 after increasing the fee on a similarly manipulated transaction and losing Bitcoin. The stolen amount has not been disclosed.

Electrum has not identified the malicious servers or established how many additional users may have encountered the attack.

Version 4.8.3 Adds Signature Verification for Pending Payments

The security patch changes how Electrum handles unconfirmed transactions involving funds controlled by the user's wallet. Version 4.8.3 verifies the signatures of wallet-owned transaction inputs before accepting pending transactions into its local history, blocking the specific substitution technique used in the reported attacks. The corresponding code change is available in the project's commit.

The corrected version was tagged on October 23, with installation packages released the following day.

The update does not introduce comprehensive verification of every unconfirmed Bitcoin transaction. Incoming payments involving external addresses remain outside the new signature checks, while confirmed transactions continue to rely on Electrum's existing verification mechanisms.

The flaw is distinct from recent wallet security incidents involving a Keystone customer data breach and hardware-wallet phishing campaigns, including the latest fake recall emails targeting Foundation Passport owners.

Electrum urges users to install version 4.8.3 from its official website and to verify the complete recipient address and payment amount before signing any transaction, including fee increases. Users connected exclusively to trusted servers, including those operating their own infrastructure, were not exposed to this particular attack.

Total financial losses remain unknown, and Electrum has not disclosed any confirmed thefts beyond the October 18 incident.