Electrum fixes flaw that let rogue servers redirect Bitcoin

The Electrum project has issued an urgent advisory urging users to upgrade to Electrum 4.8.3 after identifying a severe flaw in earlier builds that could allow rogue servers to intercept and replace broadcast transactions. The vulnerability affects unconfirmed transactions relayed by external Electrum servers that users rely on to index blockchain histories and propagate transactions, with attackers able to inject a conflicting transaction that redirects funds to an attacker address. The advisory notes that two victims reportedly lost substantial Bitcoin balances while attempting to accelerate transaction fees.

The exploitable chain hinges on how Electrum handles Replace-By-Fee (RBF) workflows and unconfirmed transactions. In legacy Electrum wallets, input signatures on unconfirmed transactions were not validated before display, allowing forged transactions to appear legitimate while masking the authentic broadcast.

In attacks, a malicious server could substitute a fraudulent transaction into the user’s transaction history, and, when a user chose to increase network fees, the wallet could generate valid cryptographic signatures for the replacement, effectively broadcasting the attacker’s transaction as if it were authorised by the user. Upstream remediation, disclosed in Electrum’s security advisory GHSA-6jp4-8v48-cc5v, involved updating to version 4.8.3, released on 23 October with binaries distributed the following day.

Going forward, users are advised to verify recipient addresses in full before signing transactions, as relying on partial checks can enable address-mimicry scams.