The most dangerous step in your wallet may be the one you think is safest: “speeding up” a transaction.
Electrum released version 4.8.3 on October 24, fixing a high-severity vulnerability that was already being exploited in the wild. It affects all versions earlier than 4.8.3. Views of this topic on the platform jumped from 1,288 to 12,187 in an hour and are still climbing—this isn’t old news being recycled.
The risks, verified against multiple sources:
1. The attack chain is very specific: A malicious server intercepts a transaction you’ve just broadcast and doesn’t forward it to the network. It replaces the transaction in your wallet history with a conflicting one that pays an attacker-controlled address. When you see that the transaction isn’t confirming and use RBF to increase the fee, your wallet signs the attacker’s transaction instead.
2. People have already been affected: Electrum has received two reports. One person spotted the issue in time and lost no money; another increased the fee and lost funds. The amounts haven’t been disclosed.
3. The impersonation is sneaky: The attacker’s address can mimic the last four characters of the recipient’s address. Checking only the last few characters isn’t enough—you must verify the entire address.
There’s no need to panic, but let’s be clear about this too:
1. Two conditions must both be met for you to be affected: You connect to a malicious server, and you actively use RBF to increase the fee. Simply opening your wallet won’t make you lose coins.
2. Users connected to their own server or a trusted server aren’t affected.
3. The fix is clear: Version 4.8.3 adds a check to “verify the signature before accepting an unconfirmed transaction that spends your own coins.” Previously, it was added to the wallet history without verification.
My take: The first thing to do tonight isn’t check the market—it’s check your version. If you’re running anything earlier than 4.8.3, go to electrum.org and upgrade to 4.8.3 immediately. Until you’ve upgraded, verify the full recipient address and amount before signing anything, including a fee increase.
When would this assessment no longer hold? If the developers later expand the range of affected versions, or a new exploit emerges that bypasses 4.8.3, I’ll revise my take. For now, treat upgrading to 4.8.3 as the fix that stops the bleeding.
Which version of the wallet are you using now? When did you last upgrade? Post your version in the comments and I’ll help you check whether it’s affected.
Electrum released version 4.8.3 on October 24, fixing a high-severity vulnerability that was already being exploited in the wild. It affects all versions earlier than 4.8.3. Views of this topic on the platform jumped from 1,288 to 12,187 in an hour and are still climbing—this isn’t old news being recycled.
The risks, verified against multiple sources:
1. The attack chain is very specific: A malicious server intercepts a transaction you’ve just broadcast and doesn’t forward it to the network. It replaces the transaction in your wallet history with a conflicting one that pays an attacker-controlled address. When you see that the transaction isn’t confirming and use RBF to increase the fee, your wallet signs the attacker’s transaction instead.
2. People have already been affected: Electrum has received two reports. One person spotted the issue in time and lost no money; another increased the fee and lost funds. The amounts haven’t been disclosed.
3. The impersonation is sneaky: The attacker’s address can mimic the last four characters of the recipient’s address. Checking only the last few characters isn’t enough—you must verify the entire address.
There’s no need to panic, but let’s be clear about this too:
1. Two conditions must both be met for you to be affected: You connect to a malicious server, and you actively use RBF to increase the fee. Simply opening your wallet won’t make you lose coins.
2. Users connected to their own server or a trusted server aren’t affected.
3. The fix is clear: Version 4.8.3 adds a check to “verify the signature before accepting an unconfirmed transaction that spends your own coins.” Previously, it was added to the wallet history without verification.
My take: The first thing to do tonight isn’t check the market—it’s check your version. If you’re running anything earlier than 4.8.3, go to electrum.org and upgrade to 4.8.3 immediately. Until you’ve upgraded, verify the full recipient address and amount before signing anything, including a fee increase.
When would this assessment no longer hold? If the developers later expand the range of affected versions, or a new exploit emerges that bypasses 4.8.3, I’ll revise my take. For now, treat upgrading to 4.8.3 as the fix that stops the bleeding.
Which version of the wallet are you using now? When did you last upgrade? Post your version in the comments and I’ll help you check whether it’s affected.