Electrum Patches Critical Vulnerability After Malicious Server Attacks

The exploit targeted the trust-based model Electrum uses for unconfirmed transactions. Because the software relies on external servers for network information rather than running a full node, attackers were able to suppress legitimate broadcasts and replace them with fraudulent transactions that redirected funds to addresses they controlled. This deception became particularly effective when users attempted to adjust transaction fees, as the wallet would present the attacker's malicious transaction as a pending payment requiring authorization.

Developers confirmed at least two real-world incidents, including a case involving a multisignature wallet where a user lost funds after attempting to increase a fee. Investigators noted that attackers used lookalike addresses to bypass casual visual checks. The newly released version 4.8.3 forces signature verification for unconfirmed transactions, ensuring that any payment displayed in the user’s history is cryptographically valid. Users are strongly advised to update immediately or connect exclusively to trusted, self-hosted servers to mitigate the risk.