Electrum has confirmed that at least one Bitcoin theft resulted from a wallet bug that allowed malicious servers to alter pending payments, according to a security advisory published by the developers. Attackers exploited the flaw to redirect funds when users attempted to raise transaction fees through Bitcoin's Replace-by-Fee feature. The team shipped a fix, version 4.8.3, on October 24, 2026.

The disclosure followed two private reports received this month. Electrum relies on servers for transaction records and broadcasting, a design that keeps the wallet light but makes the displayed history only as reliable as the server answering each request — an architecture that gave attackers a window to intervene before payments reached the Bitcoin network.

How the Bug Worked

An attacker-controlled server could withhold a valid Bitcoin payment and present a different pending transaction in its place. The fraudulent record listed the attacker's address as the recipient. Older versions of Electrum did not verify the signature on such a record before displaying it in the wallet's history. Signature verification is the step that ties a shown payment to the wallet's own keys, so skipping it left the displayed history open to whatever the server supplied, regardless of what the wallet had actually produced.

A user who then selected Replace-by-Fee, a Bitcoin mechanism for resending a pending payment with a higher fee, could cause Electrum to sign the substituted payment, rendering it valid. Unlike a recent Keystone hardware wallet customer data breach, this attack tricked users into approving altered payment details.

Two Reports Prompted the Patch

The first report arrived on October 11 from a user operating a two-of-three multisignature wallet with two Trezor devices. The user verified the original payment on both devices, yet later discovered a different transaction in their Electrum history. That report did not mention any loss.

On October 18, a second user reported losing bitcoin after raising the fee on a substituted payment. Developers did not disclose the amount involved. Both reports described attacker addresses that ended in the same four characters as the intended destinations — an overlap that can slip past checks relying on the closing characters of an address — and one substituted payment carried no fee at all, a detail that could make it appear stuck.

A separate incident, the Railway platform breach linked to crypto theft, involved suspected exposed credentials rather than falsified pending payments.

Electrum Urges Upgrade After Fix

Electrum released version 4.8.3 on October 24. Developers tagged the fixed build on Friday, the day before its release. The update now checks signatures on unconfirmed transactions that spend funds controlled by the wallet. Developers classified the issue as high severity and said some servers were already using the technique against users, meaning the threat was active rather than hypothetical.

They urged users to update their wallets and to verify recipient addresses and amounts before signing any transaction. Because the added signature check exists only in 4.8.3 and later, those two precautions remain the primary safeguards for anyone who has not yet upgraded.

Other wallet suppliers have reported different threats in recent weeks. Foundation recently traced Passport phishing emails containing real purchase details to compromised service keys; those messages did not use the transaction replacement method described by Electrum.