Electrum 4.8.3 patches a high-severity malicious-server fee-bump trap disclosed on October 24, 2026.
On October 24, 2026, Electrum released 4.8.3 (advisory GHSA-6jp4-8v48-cc5v). A malicious Electrum server can swallow a just-broadcast $BTC tx and show a conflicting fake unconfirmed payment to the attacker — older clients did not check those invalid signatures. If the user RBF fee-bumps the fake tx, they sign a real payment to the attacker. Some servers were already exploiting this; two users reported it and one lost funds. Attackers also ground the last four characters of the destination address to look similar.
Upgrade to 4.8.3 or newer — all older versions are affected. The fix verifies signatures on wallet-owned inputs for mempool txs before adding them to history. Download only from electrum.org and verify signatures. Until upgraded, check the full destination address and amount before any fee bump. Trusted or self-run server users are less exposed; incoming unconfirmed txs are still not fully validated.
#Bitcoin #Electrum #CryptoSecurity #Wallet
DYOR. Not financial advice.
On October 24, 2026, Electrum released 4.8.3 (advisory GHSA-6jp4-8v48-cc5v). A malicious Electrum server can swallow a just-broadcast $BTC tx and show a conflicting fake unconfirmed payment to the attacker — older clients did not check those invalid signatures. If the user RBF fee-bumps the fake tx, they sign a real payment to the attacker. Some servers were already exploiting this; two users reported it and one lost funds. Attackers also ground the last four characters of the destination address to look similar.
Upgrade to 4.8.3 or newer — all older versions are affected. The fix verifies signatures on wallet-owned inputs for mempool txs before adding them to history. Download only from electrum.org and verify signatures. Until upgraded, check the full destination address and amount before any fee bump. Trusted or self-run server users are less exposed; incoming unconfirmed txs are still not fully validated.
#Bitcoin #Electrum #CryptoSecurity #Wallet
DYOR. Not financial advice.
