Your Bitcoin transaction is stuck. You think that paying a higher fee will resolve it. But what if, in your attempt to speed up the transaction, your Bitcoin ends up in someone else's wallet instead?
A security flaw has been discovered in Electrum, a popular Bitcoin wallet. The developers have confirmed that at least one person has had their Bitcoin stolen as a result of this bug.
How did this attack work?
# Electrum relies on external servers for certain transaction-related information.
# By controlling these servers, attackers could replace a user's legitimate pending transaction with a fake one—one that directed the Bitcoin to the attacker's own address.
# The issue is even more subtle: when a user increased the fee to speed up their transaction, the attackers could use Bitcoin’s "Replace-by-Fee" (RBF) feature to sign the fake transaction as a valid one. Consequently, the user would unknowingly send their Bitcoin to someone else's wallet.
# In some instances, the last four characters of the attacker's address were made to match those of the intended recipient's address, making it easy to overlook the discrepancy during a quick check.
On October 24, the Electrum developers released version 4.8.3, which includes a fix for this vulnerability. Users of older versions are strongly advised to update immediately.
It is important to clarify that the Bitcoin network itself has not been hacked; the issue lay specifically in how the Electrum wallet verified pending transactions.
Therefore, when conducting crypto transactions, always double-check not just the fee, but also the recipient's address and the amount. If you use Electrum, ensure you update to the latest version from the official website.
After all, in the world of crypto, a single wrong click can prove to be very costly.