Electrum disclosed a security flaw on October 24 that could allow attackers to redirect Bitcoin payments through a fee adjustment. The vulnerability affected the wallet's transaction approval process, with the developer advisory reporting two affected users, including one who lost money.
How the Vulnerability Worked
The flaw involved malicious servers substituting an unconfirmed wallet-history entry. When a user approved a replacement transaction to raise its fee, they could inadvertently authorize payment to an attacker instead of the intended recipient. This differed from simple private-key theft, as the wallet owner could make the correct initial payment but still encounter a dangerous second signing request during the fee-bump process.
Electrum uses lightweight client architecture, retrieving transaction information from servers rather than requiring users to run a complete node. While this reduces computational overhead, it meant the wallet interface needed to carefully verify remote data, particularly for unconfirmed transactions.
Version 4.8.3 Resolution
Electrum version 4.8.3 closes the wallet-history weakness. The project directs users to download from its official site and to verify signatures, cautioning against accepting updates from unsolicited sources during the patching process.
The patch addresses the specific vulnerability but does not reverse Bitcoin transfers already confirmed to the wrong recipient. Users should verify that recipients and amounts match their intention when approving any transaction, including fee adjustments. A fee increase remains a new transaction approval requiring fresh verification before signing.
