The nastiest thing about this Electrum vulnerability is that it exploits your caution
On October 24, Electrum announced a high-severity vulnerability affecting all versions before 4.8.3. The team says servers have already used this attack in the wild. They’ve confirmed two reports, and one person lost money.
The attack is simple: you broadcast a transaction, but a malicious server doesn’t relay it—it swallows it. Then it slips a fake transaction into your wallet history, using the same inputs to send almost all your funds to the attacker’s address, with the fee displayed as zero.
Your transaction is stuck, and the fee is zero. What’s the natural response? Manually bump the fee—in other words, use RBF.
That’s when Electrum signs the fake transaction, and your money goes straight into the attacker’s pocket.
Even more devious: the last four characters of the attacker’s address match those of the address you originally intended to send to.
This is a reminder to everyone managing their own funds:
1. Don’t verify an address by checking just the first or last few characters. Check the entire address, and scan a QR code instead of typing it whenever possible.
2. If a transaction is stuck, don’t use RBF directly in your wallet. Look up the txid on mempool.space to check its real status, and make sure the transaction is actually on-chain before taking action.
Updating to 4.8.3 is the bare minimum, not the whole solution.
Wallet security isn’t just about installing an update—it’s about not cutting corners at every step 👀
$BTC #Electrum #钱包安全 #BTC
On October 24, Electrum announced a high-severity vulnerability affecting all versions before 4.8.3. The team says servers have already used this attack in the wild. They’ve confirmed two reports, and one person lost money.
The attack is simple: you broadcast a transaction, but a malicious server doesn’t relay it—it swallows it. Then it slips a fake transaction into your wallet history, using the same inputs to send almost all your funds to the attacker’s address, with the fee displayed as zero.
Your transaction is stuck, and the fee is zero. What’s the natural response? Manually bump the fee—in other words, use RBF.
That’s when Electrum signs the fake transaction, and your money goes straight into the attacker’s pocket.
Even more devious: the last four characters of the attacker’s address match those of the address you originally intended to send to.
This is a reminder to everyone managing their own funds:
1. Don’t verify an address by checking just the first or last few characters. Check the entire address, and scan a QR code instead of typing it whenever possible.
2. If a transaction is stuck, don’t use RBF directly in your wallet. Look up the txid on mempool.space to check its real status, and make sure the transaction is actually on-chain before taking action.
Updating to 4.8.3 is the bare minimum, not the whole solution.
Wallet security isn’t just about installing an update—it’s about not cutting corners at every step 👀
$BTC #Electrum #钱包安全 #BTC
