In Electrum, adding a fee to a transfer also means checking the recipient address again. The vulnerability disclosed on October 24 exploited the habit of users thinking they were only speeding up the original transaction.
According to the official security bulletin, a malicious server could hold back a newly broadcast transaction, then return to an older wallet a fake transaction with the recipient address replaced. Its signature was originally invalid and could not directly move the bitcoin; but if the user performed an RBF fee bump on it, the wallet might re-sign it, turning the payment into a real one.
The bulletin also mentioned that the attacker’s address was deliberately matched to the last four digits of the original address. A quick glance at the end of the address makes it easy to miss the problem.
Versions below 4.8.3 are affected, and 4.8.3 has added the relevant signature checks. People using Electrum can first verify the update and the download signature on electrum.org; every time you sign, including when adding a fee, check the full recipient address and amount.
This is a wallet operation risk; upgrading cannot replace checking before signing. Crypto assets still carry price volatility risk.
Binance Wallet invitation code: MOLLY666
According to the official security bulletin, a malicious server could hold back a newly broadcast transaction, then return to an older wallet a fake transaction with the recipient address replaced. Its signature was originally invalid and could not directly move the bitcoin; but if the user performed an RBF fee bump on it, the wallet might re-sign it, turning the payment into a real one.
The bulletin also mentioned that the attacker’s address was deliberately matched to the last four digits of the original address. A quick glance at the end of the address makes it easy to miss the problem.
Versions below 4.8.3 are affected, and 4.8.3 has added the relevant signature checks. People using Electrum can first verify the update and the download signature on electrum.org; every time you sign, including when adding a fee, check the full recipient address and amount.
This is a wallet operation risk; upgrading cannot replace checking before signing. Crypto assets still carry price volatility risk.
Binance Wallet invitation code: MOLLY666
