Electrum releases security patch for Bitcoin wallet flaw

The developers of Electrum, a widely used lightweight Bitcoin wallet, have released version 4.8.3 to address a high-severity security vulnerability. The flaw allowed malicious servers to exploit the wallet’s client-server architecture by substituting legitimate, unconfirmed transactions with fraudulent ones.

In the reported exploit, a compromised server could intercept a user’s intended payment and present a fake transaction to the wallet. This fake transaction often used a lookalike address where the final four characters matched the legitimate destination to avoid detection. The vulnerability became critical when users attempted to use the ‘Replace-By-Fee’ (RBF) feature to speed up a transaction. By approving a fee increase on what they believed was their original payment, users inadvertently signed the attacker’s fraudulent transaction instead.

While the exact scale of the theft remains unconfirmed, developers reported that at least one user lost funds. The project has issued an advisory (GHSA-6jp4-8v48-cc5v) and strongly urges all users to upgrade to version 4.8.3 immediately via the official Electrum website to close the vulnerability.