Electrum tells bitcoin users to upgrade now after rogue servers swapped payments for fakes and a user lost funds by bumping the fee

Electrum has told its users to upgrade immediately after finding that attackers were using rogue servers to steal bitcoin. In a security advisory published on Saturday, the wallet's developers described a high-severity flaw in every version before 4.8.3. Electrum is a light wallet that relies on outside servers for transaction histories and broadcasting. A malicious server could drop a transaction the user had just sent, feed the wallet a conflicting, invalid transaction that paid an attacker's address, and the wallet would display it as a normal pending payment without checking its signatures.

The trap closed when the user tried to speed the payment up. The fake transaction seen in the wild carried a zero fee, the advisory said, likely to prompt a fee bump. Raising the fee with replace-by-fee made the wallet sign the attacker's version at a higher fee. Bitcoin.com News reported that attacker addresses even matched the last four characters of the intended destination, so a quick glance would not catch the switch.

A user privately reported the substitution on October 11, and another reported losing money after a fee bump on October 18, per the advisory. The fix, which makes the wallet verify signatures on its own inputs before adding unconfirmed transactions to its history, was tagged on October 23 and released with the public disclosure on Saturday. No total loss figure was given. Electrum's site warns users to download only from electrum.org and verify the signatures.