According to Decrypt at 00:41 on 27/10, Electrum patched a vulnerability that allowed a malicious server to swap out a pending Bitcoin transaction and trick users into signing a transaction that sent funds directly to the attacker’s address.
A developer confirmed that servers had exploited the vulnerability and that two reports had been received. One user lost funds after increasing the fee for a fake transaction. The vulnerability affected all Electrum versions earlier than 4.8.3.
The patch, released on 24/10, adds a digital signature check for unconfirmed transactions that the wallet itself spends from—in other words, it checks whether the transaction was actually signed by the wallet owner. Transactions receiving funds from external addresses are not covered by this patch.
This is a bug in how the wallet handles unconfirmed transactions, not evidence that the Bitcoin network was compromised. Electrum users should update to the latest version and carefully check the recipient address and amount before signing.
A developer confirmed that servers had exploited the vulnerability and that two reports had been received. One user lost funds after increasing the fee for a fake transaction. The vulnerability affected all Electrum versions earlier than 4.8.3.
The patch, released on 24/10, adds a digital signature check for unconfirmed transactions that the wallet itself spends from—in other words, it checks whether the transaction was actually signed by the wallet owner. Transactions receiving funds from external addresses are not covered by this patch.
This is a bug in how the wallet handles unconfirmed transactions, not evidence that the Bitcoin network was compromised. Electrum users should update to the latest version and carefully check the recipient address and amount before signing.