Malicious Electrum servers replaced users’ just-broadcast bitcoin payments with fake zero-fee transactions paying lookalike addresses.
Servers apparently bet victims would raise the fee and sign the fake.
Electrum released version 4.8.3 on October 24 to address the high-severity flaw. Maintainer SomberNight released advisory GHSA-6jp4-8v48-cc5v the same day and requested users to upgrade.
Forged address shared a GyQ3 ending with the legitimate destination
Electrum is a light client. It doesn’t have a full bitcoin node and relies on its server for unconfirmed mempool transactions. Its own documentation explains how it works.
Someone signs and sends tx1. A bad server stops it and sends a different tx2 to the wallet that sends the money to an attacker’s address.
Tx2 has invalid signatures. Older Electrum didn’t verify signatures of mempool transactions, so the wallet showed tx2 as pending and hid tx1.
Replace-By-Fee, or RBF, permits a sender to rebroadcast an unconfirmed transaction with a higher fee. If the fee on the fake is increased, the wallet signs the attacker’s version with a valid signature.
One of the targets, known as dannydeezy, documented the attack. A 2-of-3 legacy P2SH multisig with two Trezors, 31 inputs, and one output.
User checked output on both Trezors then broadcast. Wallet history then displayed the full amount going to an unknown address unconfirmed, and the entry later flipped to “Local.”
The fake replicated the real transaction’s inputs, version and locktime, with byte identical scriptSigs on all 31 inputs.
All 62 of the signatures checked out against the real transaction. None checked out against the fake.
Almost all of it was sent to a lookalike address, with a small amount being sent back to one of the wallet’s own used addresses.
The fake ended in GyQ3. So did the real endpoint.
The attacker had figured out an address which matched the last four characters of the correct address.
ZachXBT has also called out a similar address-poisoning scam affecting Phantom wallet users. Spoofed addresses are made impervious to a glance at the first and last characters.
Version 4.8.3 checks signatures only on wallet-owned inputs
Another user, Raju-K12, privately reported on Oct. 18 that they bumped the fee on the fake and lost money. Some servers are running the attack in the wild, the maintainers say.
Commit 90fe308 adds a check for signatures on wallet-owned “is_mine” inputs before adding a mempool transaction to local history. Version 4.8.3 was git-tagged on October 23 and binaries were released the next day.
Electrum still checks only inputs the wallet controls. So unconfirmed incoming transactions go unchecked.
This is because the client has no full script interpreter.
Electrum’s workaround for anyone who can’t upgrade is to verify output addresses and amounts before signing anything, including fee bumps. Those users who connected only to their own servers were never affected.
Electrum has shipped emergency fixes in the past. In January 2018, it closed down a JSON RPC interface that had been left open for some two years, after Google researcher Tavis Ormandy found that a website could detect the port and drain funds.
Cryptopolitan reported that a Coldcard seed-generation bug warning came in July, the same day approximately 594 BTC, ~$38 million, was drained from about 500 wallets.
If you're reading this, you’re already ahead. Stay there with our newsletter.