Protocols & Policy · Wallets
Electrum patches live attack that redirects fee-bump payments
Version 4.8.3 closes a high-severity bug where a malicious server can hide a just-sent payment and lure a fee bump that pays the attacker, and the project's advisory says the attack is already in the wild.
Electrum, a long-running Bitcoin light wallet, released version 4.8.3 after its developers said some public servers are already running an attack that can turn a routine fee bump into a payment to an attacker, and that one reported user lost money that way [1][2].
A light wallet asks outside servers what unconfirmed payments look like, instead of checking the full Bitcoin network itself. According to GitHub Security Advisory GHSA-6jp4-8v48-cc5v, rated high, a malicious Electrum server can hide the transaction a user just broadcast and show the wallet a different, invalid conflicting transaction that pays the attacker. If the user then raises the fee on what looks like a stuck payment (a replace-by-fee, or RBF, fee bump), the wallet builds and signs a replacement that pays the attacker [1].
The project's own X account, @ElectrumWallet, posted at 6:06 a.m. ET on Oct. 24: "This release fixes a critical security issue, so we urge all users to upgrade. A description of the vulnerability will be published later today" [3]. RELEASE-NOTES labels 4.8.3 a "(security update)" dated October 23, 2026, and points to the same advisory [2]. The advisory was published at 8:52 a.m. ET on Oct. 24 [1].
The advisory says "some servers are performing this attack in the wild," citing two private user reports; in one, the user "bumped the fee of tx2 and lost money." It does not state a total amount lost. Attackers ground destination addresses so the last four characters matched the intended recipient, which can fool a glance at a truncated address [1].
Until users upgrade, the advisory's workaround is to check outputs carefully before any signature: "when signing any transaction, for bumping the fee or not, they should verify the output addresses and amounts are as expected." Clients that connect to servers they trust, for example by running their own, "are not affected" [1].
The patch in 4.8.3 verifies signatures on the wallet's own inputs for mempool transactions the server sends, so a forged conflicting payment should no longer land in history [1][2].
Sources
- GitHub Security Advisory GHSA-6jp4-8v48-cc5v, spesmilo/electrum, published Oct. 24, 2026, 8:52 a.m. ET, https://github.com/spesmilo/electrum/security/advisories/GHSA-6jp4-8v48-cc5v, accessed Oct. 24, 2026, 9:23 a.m. ET.
- Electrum RELEASE-NOTES, "Release 4.8.3 (October 23, 2026) (security update)," https://raw.githubusercontent.com/spesmilo/electrum/master/RELEASE-NOTES, accessed Oct. 24, 2026, 9:23 a.m. ET.
- Electrum (@ElectrumWallet), post on X, Oct. 24, 2026, 6:06 a.m. ET, https://x.com/ElectrumWallet/status/2113935057656369564, accessed Oct. 24, 2026, 9:23 a.m. ET.
Holding the Corner.
Not financial advice.