- Electrum disclosed a high-severity vulnerability affecting versions before 4.8.3.
- The flaw could let malicious servers mislead users signing Bitcoin fee-increase transactions.
- Developers reported active exploitation, and at least one confirmed BTC loss.
Electrum disclosed a high-severity vulnerability on October 24 via Replace-by-Fee (RBF) attacks affecting all Electrum versions earlier than 4.8.3. Version 4.8.3 introduced additional transaction-signature checks.
Electrum’s advisory describes how malicious servers can mislead users into authorizing a fraudulent transaction during a fee increase. Developers have confirmed at least one instance of lost Bitcoin (BTC) out of the two reported incidents, highlighting a potential blind spot in Bitcoin self-custody.
How a Legitimate Bitcoin Payment Became a Potential Theft
On October 24, 2026, Electrum released a security advisory (GHSA-6jp4-8v48-cc5v) covering all versions before 4.8.3, after receiving two private theft reports. The vulnerability enabled the malicious server to use a normal outgoing payment as an opportunity for theft.
On October 11, the first reported a misaligned history post broadcast. The second, from user Raju-K12, on October 18, was about the actual loss of money following a fee bump. Developers confirmed that some public servers were already performing the attack.
For instance, if a user signs a legitimate Bitcoin transaction (tx1) and broadcasts it through a connected server. But if a malicious server withholds tx1 and injects a conflicting, invalid transaction (tx2) into the wallet’s history, it will replace the intended outputs with the attacker’s address. And when the user attempts an RBF fee increase to speed up the “stuck” payment, the vulnerable wallet will sign the fraudulent transaction instead.
But version 4.8.3, tagged on October 23 and released with binaries on October 24, bridged the gap by preventing signature validation of inputs that incur spending coins in the wallet before an unconfirmed transaction is added to local history.
Follow us on X for real-time crypto updates.
Bitcoin Self-Custody: Why Controlling the Keys Isn’t the Same as Verifying the Transaction
Self-custody is commonly referred to as “not your keys, not your coins.” That’s true, but it’s not necessarily complete. Private keys, or the hardware device that stores them, are just one part of a functional self-custody solution. The wallet software needs to assemble and display the transaction properly, and the user needs to check the inputs, outputs, amount, and fees before signing.
Self-custody gives users control over their private keys, but it does not guarantee that wallet software will always display transaction details correctly. Electrum relies on its connected server for information about unconfirmed transactions, creating a potential risk if a malicious server supplies fraudulent transaction data.
Although the private keys remained under the user’s control, developers have confirmed at least one instance of lost BTC out of the two reported incidents. That said, the incident raises a vital difference: having the keys in control means that a custodian cannot unilaterally control the funds, but does not imply that all transactions a wallet requests the user to sign are what they intend.
How Electrum Users Can Reduce the Risk
Electrum recommends upgrading to version 4.8.3. Users should download the update from the official website and verify its signature. Those unable to upgrade immediately should check the complete recipient addresses and transaction amounts before signing any transaction, including fee increases. Checking only the final few characters of an address is insufficient, as the reported attackers used addresses that matched the legitimate recipient’s last four characters.
Subscribe to our YouTube channel for the latest crypto news.
Related: XRP Ledger Confirms No New XRP Created After Critical Vulnerability
Disclaimer: The information presented in this article is for informational and educational purposes only. The article does not constitute financial advice or advice of any kind. Coin Edition is not responsible for any losses incurred as a result of the utilization of content, products, or services mentioned. Readers are advised to exercise caution before taking any action related to the company.
