One tap to speed up a transfer, and your coins are gone! This old-school Bitcoin wallet’s trick is seriously shady 😂
On October 24, an official disclosure revealed a critical vulnerability. Right after you send a transfer, a malicious server can hold it back without broadcasting it, then insert a fake transaction into your wallet’s history. The fake transaction’s recipient address is deliberately made to match the last four characters of the real address, and its fee is almost zero—just waiting for you to tap “Speed up.”
Older wallet versions don’t verify the signature on this unconfirmed transaction. If you tap RBF to increase the fee, what you sign is the real transfer to the attacker. The developers said servers in the wild are already doing this. They’ve received two user reports, and one person really did lose coins after tapping “Speed up.” All versions before 4.8.3 are affected; the fix is in 4.8.3.
You’re safe if you run your own trusted node. Everyone else should check the recipient address and amount from beginning to end every time before signing an upgrade. Don’t just look at the last few characters. In crypto, sometimes all it takes to lose your coins is that one tap.
On October 24, an official disclosure revealed a critical vulnerability. Right after you send a transfer, a malicious server can hold it back without broadcasting it, then insert a fake transaction into your wallet’s history. The fake transaction’s recipient address is deliberately made to match the last four characters of the real address, and its fee is almost zero—just waiting for you to tap “Speed up.”
Older wallet versions don’t verify the signature on this unconfirmed transaction. If you tap RBF to increase the fee, what you sign is the real transfer to the attacker. The developers said servers in the wild are already doing this. They’ve received two user reports, and one person really did lose coins after tapping “Speed up.” All versions before 4.8.3 are affected; the fix is in 4.8.3.
You’re safe if you run your own trusted node. Everyone else should check the recipient address and amount from beginning to end every time before signing an upgrade. Don’t just look at the last few characters. In crypto, sometimes all it takes to lose your coins is that one tap.