Electrum users: update to 4.8.3 now.
Electrum published a high-severity advisory (Oct 24): a malicious server can "swallow" a transaction you just broadcast and show a fake look-alike in your history, paying the attacker instead.
How the trap works:
• The fake tx has invalid signatures, but light clients trust the server's mempool view
• The attacker address is ground to match the last 4 characters of yours
• The fake tx can carry zero fee, nudging you to hit RBF fee-bump
• Bump it, and your wallet signs a real payment to the attacker
This isn't theoretical. Electrum says some servers are doing it in the wild: two user reports, and one user lost funds after bumping.
What to do:
• Update to 4.8.3 from electrum.org only, and verify the signature
• If a pending tx looks "different" or shows zero fee, don't bump it; check the full address on a block explorer
• Running your own server avoids this class of attack
Context: $BTC ~$80,519 on Binance spot (04:20 local time, -0.9% 24h, low $79,221). Volatile days push people to fee-bump in a hurry, which is exactly what this attack exploits.
Do you check the full address, or just the last few characters?
Advisory: https://github.com/spesmilo/electrum/security/advisories/GHSA-6jp4-8v48-cc5v
Release notes: https://github.com/spesmilo/electrum/blob/master/RELEASE-NOTES
#WriteToEarn
Not financial advice. DYOR.
Electrum published a high-severity advisory (Oct 24): a malicious server can "swallow" a transaction you just broadcast and show a fake look-alike in your history, paying the attacker instead.
How the trap works:
• The fake tx has invalid signatures, but light clients trust the server's mempool view
• The attacker address is ground to match the last 4 characters of yours
• The fake tx can carry zero fee, nudging you to hit RBF fee-bump
• Bump it, and your wallet signs a real payment to the attacker
This isn't theoretical. Electrum says some servers are doing it in the wild: two user reports, and one user lost funds after bumping.
What to do:
• Update to 4.8.3 from electrum.org only, and verify the signature
• If a pending tx looks "different" or shows zero fee, don't bump it; check the full address on a block explorer
• Running your own server avoids this class of attack
Context: $BTC ~$80,519 on Binance spot (04:20 local time, -0.9% 24h, low $79,221). Volatile days push people to fee-bump in a hurry, which is exactly what this attack exploits.
Do you check the full address, or just the last few characters?
Advisory: https://github.com/spesmilo/electrum/security/advisories/GHSA-6jp4-8v48-cc5v
Release notes: https://github.com/spesmilo/electrum/blob/master/RELEASE-NOTES
#WriteToEarn
Not financial advice. DYOR.