Electrum Fixes Wallet Flaw Exploited by Malicious Servers in Fee-Bump Trap, One User Loses Funds

Published October 25, 2026, 2:45 AM PKT. Based on Electrum's security advisory and release announcement of October 24, 2026 (primary source), and reporting by The Cryptonomist, PANews and The Defiant (secondary sources), all October 24, 2026, plus BtcMedia's timeline reconstruction (secondary source), October 25, 2026.

Electrum, one of the oldest Bitcoin wallets, released version 4.8.3 on October 24, 2026 to fix a high-severity flaw that malicious servers are already exploiting in the wild, according to its security advisory reported by The Cryptonomist, PANews and The Defiant. The flaw let a hostile server swallow a user's broadcast payment, replace it in the wallet's history with a conflicting transaction paying an attacker, and then wait for the user to do something sensible, raise the fee on a stuck payment, which signed the fake payment for real. Two users reported cases tied to the flaw, and one lost funds after a fee bump, according to the advisory. The amount lost was not disclosed. All versions before 4.8.3 are affected, while users connected to their own servers are not, according to Electrum.

A fee bump signed the attacker's payment

Electrum is a light wallet, so it does not download the whole blockchain, it asks a server what is happening, and by design it trusts that server about unconfirmed transactions, according to BtcMedia and The Cryptonomist. The advisory lays out what a hostile server did with that trust. First, the user broadcast a real payment, and the server quietly swallowed it, so it never reached the Bitcoin network. Second, the server put a fake transaction in the wallet history instead, spending the same coins to the attacker's address. Third, the fake carried invalid signatures, but older clients did not check them, so it looked like a normal pending payment. Fourth, the fake carried a fee of about zero, so it would never confirm, which is exactly the kind of stuck payment a user would want to speed up.

The trap closed when the user used replace-by-fee, or RBF, to raise the fee, according to PANews and TokenPost. RBF is the fee-bump function that lets a user replace an unconfirmed transaction with a version paying a higher fee. The wallet then signed the substituted transaction with valid signatures and sent the funds to the attacker, according to PANews. In both reported cases, the attacker's destination address matched the last four characters of the address the user originally intended to pay, according to the advisory reported by The Cryptonomist and TokenPost, a detail that made the fake harder to spot on a quick check.

Two reports, one user lost funds

The first report came on October 11, 2026, from a user with a 2-of-3 multisig wallet who had checked the payment outputs on two Trezor hardware wallets before broadcasting, according to BtcMedia's timeline reconstruction. The wallet history then showed the full amount going to an unknown address, but the real transaction had never been broadcast and was still valid, according to the same reconstruction. The second user reported on October 18, 2026, after bumping the fee on a manipulated transaction, and lost funds, according to the advisory reported by PANews and BtcMedia. Electrum confirmed two incident reports tied to the vulnerability in total, including one case in which a user lost funds, according to TokenPost.

The advisory states that some servers are already performing this attack in the wild, according to The Cryptonomist and The Defiant, which is why Electrum framed the release as urgent rather than routine. The Defiant described the flaw as high severity, and PANews noted that the advisory covers every version before 4.8.3, not a single buggy release.

Version 4.8.3 checks signatures first

The fix changes what the wallet accepts into its local history, according to The Cryptonomist. Version 4.8.3 checks signatures on transaction inputs that spend coins belonging to the wallet before accepting an unconfirmed transaction into local history, whereas previously those signatures went unchecked before the transaction appeared. That single check breaks the attack, because the server's substituted transaction carries invalid signatures and is now rejected instead of displayed as a pending payment.

Electrum urged all users to upgrade, writing in its release announcement that this release fixes a critical security issue, according to The Cryptonomist. Users should get the software exclusively from electrum.org and check its GPG signatures, according to the same report. For users who have not yet upgraded, Electrum recommends checking the destination address and amount manually before signing any transaction, including a fee increase, according to PANews and The Defiant. Clients connected to trusted servers, including their own servers, are not affected by this attack, according to the advisory.

Bull Bitcoin adds the same check

The disclosure rippled to wallets built on Electrum's design the same day. Bull Bitcoin chief executive Francis Pouliot said BULL wallet users were unaffected unless they had manually chosen a compromised server, according to The Cryptonomist. By default, BULL connects only to two Bull Bitcoin-operated servers and one operated by Blockstream, and connecting elsewhere requires adding a server address manually, according to the same report. Pouliot added that Bull Bitcoin is immediately adding client-side validation using the same approach as Electrum, a sign that other Electrum-based wallets may need the same fix even where their default servers are safe.

What users should do now

The practical steps follow directly from the advisory. Upgrade to version 4.8.3 before sending or fee-bumping anything, and until the upgrade is done, verify the full recipient address and the amount on every signing screen, not just the last four characters, since the attackers deliberately matched those. Users who run their own Electrum server, or who connect only to a server they trust, are not exposed to this attack, according to the advisory, which makes a personal server the strongest mitigation short of the upgrade itself. Anyone who bumped a fee on a stuck payment in recent weeks and saw the destination change should treat that payment as suspect and check whether the original transaction is still valid and unbroadcast, as it was in the October 11 case.

This article is news reporting and is not investment advice.

Sources

• Electrum, security advisory and release announcement for version 4.8.3 (October 24, 2026), primary source
• The Cryptonomist, Electrum Wallet Security Flaw Fixed in Version 4.8.3 Update (October 24, 2026), secondary source
• PANews, Electrum Discloses High-Severity Flaw Exploited in the Wild, With User Funds Lost (October 24, 2026), secondary source
• The Defiant, Electrum Patches Wallet Flaw Exploited Through Malicious Servers (October 24, 2026), secondary source
• BtcMedia, Electrum's Fee-Bump Trap: A Fake Payment That Copied the Last Four Characters (October 25, 2026), secondary source
• TokenPost, Electrum Fixes Bitcoin (BTC) Wallet Flaw Exploited by Malicious Servers (October 24, 2026), secondary source