Electrum releases urgent update to block wallet exploit

Electrum patches wallet flaw exploited by malicious servers

Electrum, a popular Bitcoin wallet, released version 4.8.3 on October 24 to fix a security gap. This update stops a specific type of attack where a malicious server could trick users into sending Bitcoin to the wrong address.

The project urged all users to upgrade immediately. The security advisory states that some servers are already carrying out this attack, and one user reported losing money because of it.

Key facts

• Version 4.8.3 fixes a critical security issue affecting all previous versions.


• The attack involved a malicious server substituting a fake payment destination.


• Two user reports were received, including one confirmed loss of funds.


• The exploit relied on the wallet's trust in the server for transaction data.


• Bull Bitcoin announced it is adding similar checks to its BULL wallet.

How the exploit worked

Electrum relies on servers to fetch transaction history and broadcast payments. The vulnerability existed because the wallet trusted the server to display accurate unconfirmed transactions. A malicious server could withhold a user's original payment and insert a conflicting transaction into the history. This fake transaction pointed to an attacker-controlled address instead of the intended recipient.

Older versions of Electrum did not check the signatures on these inputs before displaying them as unconfirmed. If a user then manually raised the transaction fee using a feature called replace-by-fee, or RBF, the wallet would sign the altered transaction. This effectively sent the user's Bitcoin to the attacker. The advisory noted that in both reported cases, the attacker used addresses that matched the last four characters of the intended destination to make the error harder to spot.

Electrum's official response

In its release announcement, the Electrum team stated: “This release fixes a critical security issue, so we urge all users to upgrade.” Version 4.8.3 now checks signatures on inputs that spend the wallet's own coins before adding unconfirmed transactions to its local history. The project noted that clients connecting to trusted servers, such as those run by Electrum itself, were not affected by this specific attack.

Bull Bitcoin adds similar protections

Francis Pouliot, CEO of Bull Bitcoin, said his company's BULL wallet connects by default only to servers run by Bull Bitcoin and Blockstream. He confirmed that BULL users were unaffected unless they had manually selected a compromised server. However, Pouliot announced that Bull Bitcoin is immediately adding client-side validation using the same approach as Electrum to protect against future risks.

What users should do now

Electrum advises all users to upgrade to version 4.8.3. For those who have not updated yet, the project suggests a workaround: carefully verify destination addresses and amounts every time you sign a transaction, especially when increasing fees. The project also reminds users to download software only from the official electrum.org website and to verify GPG signatures to ensure they are using the genuine application.

Sources

• The Defiant

Read also: Bitcoin Core changes policy to speed up security fixes for outdated nodes