#Electrum钱包漏洞致资金被盗 Everyone, pay attention! There’s a problem with the Electrum wallet—upgrade to 4.8.3 right away.
Malicious servers are up to no good: they can intercept a transaction you just sent and secretly replace it with a fake one, changing the recipient address to the hacker’s. The fake transaction’s signature is invalid, but older versions don’t check it and simply show it as “Unconfirmed.”
When you see the transaction is stuck, you might instinctively click “Speed up” (RBF)—and then you really do end up signing a transaction to the hacker.
Even worse, they deliberately make the last four characters of the fake address match the address you originally meant to send to, to trick people who only check the ending.
The developers have received two reports so far, and one person actually lost money after trying to speed up a transaction. Some servers are already doing this in practice.
Do these things now:
• Upgrade to 4.8.3 immediately. Download it only from the official website, and remember to verify the signature.
• Before upgrading, don’t try to speed up any unconfirmed transactions that look suspicious.
• Always check the full address and amount before signing. Don’t take shortcuts by checking only the first or last few characters.
• Using your own server is relatively safer, but upgrading is still the best option.
Keeping your private keys safe doesn’t mean your money is safe—your transactions can be exploited too. Don’t let your guard down.
Malicious servers are up to no good: they can intercept a transaction you just sent and secretly replace it with a fake one, changing the recipient address to the hacker’s. The fake transaction’s signature is invalid, but older versions don’t check it and simply show it as “Unconfirmed.”
When you see the transaction is stuck, you might instinctively click “Speed up” (RBF)—and then you really do end up signing a transaction to the hacker.
Even worse, they deliberately make the last four characters of the fake address match the address you originally meant to send to, to trick people who only check the ending.
The developers have received two reports so far, and one person actually lost money after trying to speed up a transaction. Some servers are already doing this in practice.
Do these things now:
• Upgrade to 4.8.3 immediately. Download it only from the official website, and remember to verify the signature.
• Before upgrading, don’t try to speed up any unconfirmed transactions that look suspicious.
• Always check the full address and amount before signing. Don’t take shortcuts by checking only the first or last few characters.
• Using your own server is relatively safer, but upgrading is still the best option.
Keeping your private keys safe doesn’t mean your money is safe—your transactions can be exploited too. Don’t let your guard down.