Electrum’s wallet flaw let malicious servers replace pending Bitcoin transactions with fake payments that users could authorize to attackers when raising fees through Replace-by-Fee; developers confirmed at least one theft. Electrum disclosed the vulnerability on Saturday, according to CoinDesk, and released version 4.8.3 on Oct. 24 to check signatures on unconfirmed transactions. Earlier versions remain vulnerable when connected to malicious servers, whose identities and the amount stolen have not been disclosed. Developers recommend upgrading and verifying addresses and amounts before signing; users connected only to trusted servers, including their own, were not exposed.