updated Electrum last month and feel safe? not if "last month" means 4.8.2
every version before 4.8.3 carries the high-severity flaw, and 4.8.2 came out September 11 as a security update itself. easy to think you're covered
4.8.3 shipped its binaries on October 24
the fix is narrow: Electrum now verifies signatures on unconfirmed transactions that spend your wallet's own coins
incoming unconfirmed ones still aren't validated. don't trust what lands in your history until it confirms
my checklist, straight from the advisory:
update from the official site
until you do, check the full output address and amount on every fee bump, not just the last characters
own server only? not affected
no source says keys leaked or funds need moving. a "migrate your $BTC
" message is how one theft becomes two
#ElectrumFixesHighRiskExploitInVersionsBefore4.8.3
every version before 4.8.3 carries the high-severity flaw, and 4.8.2 came out September 11 as a security update itself. easy to think you're covered
4.8.3 shipped its binaries on October 24
the fix is narrow: Electrum now verifies signatures on unconfirmed transactions that spend your wallet's own coins
incoming unconfirmed ones still aren't validated. don't trust what lands in your history until it confirms
my checklist, straight from the advisory:
update from the official site
until you do, check the full output address and amount on every fee bump, not just the last characters
own server only? not affected
no source says keys leaked or funds need moving. a "migrate your $BTC
" message is how one theft becomes two
#ElectrumFixesHighRiskExploitInVersionsBefore4.8.3
