🚨 Raising a transaction fee could send your $BTC to a scammer.
Electrum disclosed a vulnerability that turned a routine transaction speed-up into a potential theft.
A malicious server could hide the original payment and display a fake transaction pointing to the attacker’s address. Its signatures were invalid, but older wallet versions did not check them.
When the user increased the fee through Replace-by-Fee (RBF), the wallet signed the substituted transaction authorizing payment to the attacker.
To disguise the swap, attackers generated addresses matching the last four characters of the intended recipient’s address. Developers received two reports, including one involving lost funds.
✅ The fix is available in Electrum 4.8.3. Update before your next transaction. Download only from electrum org and verify the installer’s GPG signature.
My takeaway: self-custody requires checking exactly what you sign. Even a familiar “increase fee” action deserves another look at the full destination address and amount. Four matching characters are not enough.
This incident concerns wallet security and trust in servers. Bitcoin’s underlying protocol was not compromised.
$BTC
Electrum disclosed a vulnerability that turned a routine transaction speed-up into a potential theft.
A malicious server could hide the original payment and display a fake transaction pointing to the attacker’s address. Its signatures were invalid, but older wallet versions did not check them.
When the user increased the fee through Replace-by-Fee (RBF), the wallet signed the substituted transaction authorizing payment to the attacker.
To disguise the swap, attackers generated addresses matching the last four characters of the intended recipient’s address. Developers received two reports, including one involving lost funds.
✅ The fix is available in Electrum 4.8.3. Update before your next transaction. Download only from electrum org and verify the installer’s GPG signature.
My takeaway: self-custody requires checking exactly what you sign. Even a familiar “increase fee” action deserves another look at the full destination address and amount. Four matching characters are not enough.
This incident concerns wallet security and trust in servers. Bitcoin’s underlying protocol was not compromised.
$BTC
