$BTC 🚨 Critical vulnerability in Electrum: what happened and what it led to
The developers of the Electrum bitcoin wallet have released an emergency update 4.8.3, which closes a dangerous security vulnerability. Attackers have found a way to quietly replace user transactions, and the developers have already confirmed the real facts of theft.
We analyze the main details of the incident and its consequences for the entire market.
⚙️ What was the vulnerability?
Attackers controlling malicious Electrum servers could intercept and replace bitcoin transactions waiting for confirmation.
Attack scheme:
1. The user sends a transaction, but sees that it is frozen and decides to speed it up using the Replace-by-Fee (RBF) function, increasing the commission.
2. A malicious server pushes a fake transaction.
3. The user, thinking that he is just paying extra to the miners, actually signs the transfer of funds to the attackers' wallet.
The exact amount of stolen funds and the names of the owners of malicious servers are not disclosed. Everyone who used old versions and connected to random public servers was at risk. Users of their own nodes and trusted nodes were not threatened.
The developers of the Electrum bitcoin wallet have released an emergency update 4.8.3, which closes a dangerous security vulnerability. Attackers have found a way to quietly replace user transactions, and the developers have already confirmed the real facts of theft.
We analyze the main details of the incident and its consequences for the entire market.
⚙️ What was the vulnerability?
Attackers controlling malicious Electrum servers could intercept and replace bitcoin transactions waiting for confirmation.
Attack scheme:
1. The user sends a transaction, but sees that it is frozen and decides to speed it up using the Replace-by-Fee (RBF) function, increasing the commission.
2. A malicious server pushes a fake transaction.
3. The user, thinking that he is just paying extra to the miners, actually signs the transfer of funds to the attackers' wallet.
The exact amount of stolen funds and the names of the owners of malicious servers are not disclosed. Everyone who used old versions and connected to random public servers was at risk. Users of their own nodes and trusted nodes were not threatened.
