#electrum钱包漏洞致资金被盗
Electrum Wallet has once again torn away the respectable façade of “self-custody” with brutal facts. A high-severity vulnerability exploited in the wild allowed malicious servers to intercept users’ freshly broadcast transactions, replace them with a “fake pending transaction” pointing to an attacker’s address, and then quietly wait for users to press the fatal button themselves: increase the fee. RBF is a normal Bitcoin feature, but in this case it became an instrument for signing money away. No private keys were leaked, no seed phrases were phished; users simply did something entirely routine, and their money was gone. Electrum’s official team confirmed at least two reports, with one user suffering a loss whose amount remains undisclosed.
This is not the first time Electrum has used users’ losses to teach the market a lesson. From 2019 to 2020, phishing attacks using fake update pop-ups swept through the Electrum ecosystem, resulting in the theft of more than $22 million, or 1,980 bitcoins. One user lost 1,400 bitcoins in a single incident after updating their wallet, worth about $15.8 million at the time. From phishing pop-ups to RBF hijacking, the attack surface has changed, but the underlying script has never changed: as a lightweight wallet, Electrum hands external servers the “right to tell the story” of unconfirmed transactions, and anyone can run an Electrum server. What you’re trusting isn’t mathematics; it’s the honesty of a stranger.
“Control your private keys and you control everything” is a sedative that has been repeated far too many times. Electrum’s history of vulnerabilities coldly proves that having your private keys on your device does not mean you control where your transactions ultimately go. When even the “pending transactions” displayed in a wallet interface can be altered unilaterally by a server—and older versions presented them as user assets without even verifying their signatures—the myth of self-custody shatters completely in the gap between the screen and the blockchain. You may protect yourself from an exchange collapsing and from phishing sites, only to fall victim to the “speed-up” knife handed to you by the wallet itself.
Upgrading to 4.8.3 is essential, but an upgrade cannot solve one fundamental problem: How long has it been since you seriously questioned whether the transaction displayed in your wallet is actually the one you signed? The next time a transaction fee gets stuck, will you press “Speed Up” again without hesitation—and are you sure whose transaction you’re signing?
Electrum Wallet has once again torn away the respectable façade of “self-custody” with brutal facts. A high-severity vulnerability exploited in the wild allowed malicious servers to intercept users’ freshly broadcast transactions, replace them with a “fake pending transaction” pointing to an attacker’s address, and then quietly wait for users to press the fatal button themselves: increase the fee. RBF is a normal Bitcoin feature, but in this case it became an instrument for signing money away. No private keys were leaked, no seed phrases were phished; users simply did something entirely routine, and their money was gone. Electrum’s official team confirmed at least two reports, with one user suffering a loss whose amount remains undisclosed.
This is not the first time Electrum has used users’ losses to teach the market a lesson. From 2019 to 2020, phishing attacks using fake update pop-ups swept through the Electrum ecosystem, resulting in the theft of more than $22 million, or 1,980 bitcoins. One user lost 1,400 bitcoins in a single incident after updating their wallet, worth about $15.8 million at the time. From phishing pop-ups to RBF hijacking, the attack surface has changed, but the underlying script has never changed: as a lightweight wallet, Electrum hands external servers the “right to tell the story” of unconfirmed transactions, and anyone can run an Electrum server. What you’re trusting isn’t mathematics; it’s the honesty of a stranger.
“Control your private keys and you control everything” is a sedative that has been repeated far too many times. Electrum’s history of vulnerabilities coldly proves that having your private keys on your device does not mean you control where your transactions ultimately go. When even the “pending transactions” displayed in a wallet interface can be altered unilaterally by a server—and older versions presented them as user assets without even verifying their signatures—the myth of self-custody shatters completely in the gap between the screen and the blockchain. You may protect yourself from an exchange collapsing and from phishing sites, only to fall victim to the “speed-up” knife handed to you by the wallet itself.
Upgrading to 4.8.3 is essential, but an upgrade cannot solve one fundamental problem: How long has it been since you seriously questioned whether the transaction displayed in your wallet is actually the one you signed? The next time a transaction fee gets stuck, will you press “Speed Up” again without hesitation—and are you sure whose transaction you’re signing?
