EN
Español
Português (Brasil)
Türkçe
Tiếng Việt
Bahasa Indonesia
Polski
Čeština
Română
Slovenčina
Magyar26 Oct 2026
Electrum has patched a high-severity bug that let malicious servers redirect Bitcoin payments when users manually raised fees with Replace-by-Fee. At least one user lost funds, and attackers used look-alike addresses matching the last four characters of the real recipient. Version 4.8.3 adds signature checks and is the fix.
Bitcoin TradeReviewed News Desk
Electrum Bitcoin wallet users are being urged to update after the developers disclosed a high-severity flaw that let attackers redirect payments without ever touching a user’s private keys. According to CryptoSlate, the bug affects all Electrum versions earlier than 4.8.3, malicious servers were actively exploiting it, and at least one user lost Bitcoin after unknowingly approving a fraudulent transaction.
How the Electrum exploit worked
Electrum is a lightweight wallet that relies on external servers to track unconfirmed transactions. That reliance was the weak point. When a user broadcast a payment, a malicious server could withhold it from the network and instead feed the wallet a conflicting version that sent the coins to an attacker-controlled address.
The substituted transaction carried invalid signatures, so on its own it could not be mined. The problem was that affected Electrum clients did not verify those signatures before showing the transaction in the wallet’s unconfirmed history. The real payment simply vanished from view, replaced by the attacker’s version that appeared to be waiting for confirmation.
The trap was then sprung through Replace-by-Fee (RBF), the Bitcoin feature that lets users raise the fee on a stuck transaction. If the victim manually bumped the fee on the fake transaction, Electrum produced fresh, valid signatures for it, authorizing the attacker’s payment details. In the October 18 incident, the attackers reportedly set the fraudulent transaction’s fee to zero, which made it look stuck and nudged the victim to speed it up.
Two complaints, look-alike addresses
The disclosure followed two user reports received on October 11 and October 18. The first user spotted an unfamiliar transaction after broadcasting a payment; the second lost funds while trying to accelerate a pending transfer. In both cases the attackers generated Bitcoin addresses that matched the final four characters of the intended recipient’s address, a trick aimed at people who only check the end of an address. Electrum has not said how much was stolen.
The fix in Electrum 4.8.3
The developers tagged version 4.8.3 on October 23 and released it on October 24 alongside the public security advisory. The update adds signature checks for wallet-owned inputs before unconfirmed transactions enter the local history, which stops the substitution before it can reach the fee-bump step. Per the advisory, clients connected only to trusted servers, including privately run ones, were not exposed. The patch does not extend signature verification to every incoming transaction.
What it means for traders
- Update first: download Electrum 4.8.3 only from the official Electrum website before using RBF again.
- Check the full address and amount every time you sign, not just the last few characters.
- Be suspicious of a zero-fee or unfamiliar pending transaction before you bump its fee.
- Know where your coins sit: if you keep part of your crypto on an exchange, compare security and licensing in our crypto exchange comparison, or read our BingX review and OKX review. Our testing methodology explains how we rate exchange security.
This article is for information only and is not investment advice.
Related reviews
Sources
News is for information only and is not financial advice. More crypto news
You'll hear it here first
Get crypto news first on our Telegram channel.