electrumwalletbug

#ElectrumWalletBugLetRogueServersStealFunds
Important: Electrum Wallet has addressed a significant vulnerability that was already being exploited.
1. A user broadcasts a typical BTC transaction.
2. A malicious Electrum server intercepts the transaction and does not transmit it to the network.
3. The server inserts a fraudulent transaction in the wallet history, directing funds to the attacker's address with an invalid signature.
4. This fake transaction appears as "stuck" with a zero fee.
5. When the user attempts to expedite the transaction using Replace-By-Fee (RBF), they unintentionally sign the fraudulent transaction.
Attackers also employed lookalike addresses that matched the last four characters of the genuine destination, causing quick checks to fail.
Two cases reported in October.
One user confirmed the loss of funds following a fee increase.
One multisig user utilizing two Trezor devices identified the fake transaction in time. - All versions prior to 4.8.3 are vulnerable. - Version 4.8.3 introduces signature verification for unconfirmed spending transactions.
Download only from http://electrum.org
and verify the signature.
Connect only to trusted or self-hosted servers.
Always verify the full address and amount before signing any RBF.
Avoid rushing a fee increase.
This information is provided for educational purposes.
Please update your wallet.

#electrumwalletbug #BitcoinSecurity