Electrum released version 4.8.3 on October 24, 2026, to fix an Electrum wallet security flaw that lets malicious servers trick users into signing payments to attackers when increasing transaction fees. Developers received two user reports, including one involving lost money, and urged everyone to upgrade.
Key takeaways
- Electrum versions earlier than 4.8.3 are vulnerable.
- A manual fee increase can authorize an attacker’s substituted payment.
- The patch validates signatures before accepting affected unconfirmed transactions.
How the Electrum wallet security flaw works
A malicious server can hide a user’s original payment and replace it in the wallet’s history with a conflicting transaction pointing to an attacker-controlled address. Electrum’s security advisory says some servers are already conducting the attack.
The wallet uses servers to retrieve transaction history and broadcast payments. Its documentation describes the main server as trusted for information about unconfirmed transactions—the trust this attack exploits.
The substituted transaction contains invalid signatures. Older clients displayed it as unconfirmed without checking those signatures first. If a user then manually increases the fee through replace-by-fee, or RBF, the wallet signs the altered payment and sends funds to the attacker.
Developers said one of the two reporting users lost money after raising a transaction’s fee. In both reports, the attacker’s destination matched the last four characters of the address the user originally intended to pay, according to the advisory.
What version 4.8.3 changes
The fix for the Electrum wallet security flaw checks signatures on transaction inputs that spend coins belonging to the wallet before accepting an unconfirmed transaction into its local history. Previously, those signatures went unchecked before the transaction appeared.
“This release fixes a critical security issue, so we urge all users to upgrade,” Electrum wrote in its release announcement. The advisory identifies all versions before 4.8.3 as affected, while saying clients connected to trusted servers, including their own servers, are not affected by this attack.
For users who have not upgraded, Electrum recommends checking destination addresses and amounts manually before signing any transaction, including a fee increase. On its download page, users are instructed to get the software exclusively from electrum.org and to check its GPG signatures.
Bull Bitcoin plans matching client-side checks
Bull Bitcoin CEO Francis Pouliot said BULL wallet users were unaffected unless they had manually chosen a compromised server. By default, BULL connects only to two Bull Bitcoin-operated servers and one operated by Blockstream.
Connecting elsewhere requires users to add a server address manually, Pouliot said. He also committed to adding validation within the wallet: “Nevertheless, we are immediately adding a client-side validation using the same approach as Electrum wallet,” he wrote.
Article produced with the assistance of artificial intelligence and reviewed by the editorial team.