The developers of Electrum, one of the oldest and most widely used Bitcoin wallets, have disclosed a serious bug that some servers were already using to steal funds. The flaw is fixed in Electrum 4.8.3, released on Saturday, October 24, 2026. Anyone on an older version should update.
Key facts
- What is affected: all Electrum versions older than 4.8.3. The developers rate the problem as high severity.
- Who is at risk: users connected to a server they don’t control. People who connect only to their own server or one they fully trust were not exposed.
- Losses: at least one user lost bitcoin. The amount has not been made public, and the developers have not identified the malicious servers.
- The fix: version 4.8.3 now checks the signatures on pending payments that spend coins from your own wallet, so a fake transaction can no longer appear in your history.
How the attack worked
Electrum is a “light” wallet: instead of downloading the whole Bitcoin blockchain, it asks outside servers for your transaction history and sends your payments through them. Before the fix, it trusted those servers on payments that were still waiting to be confirmed.
A malicious server could:
- Quietly block a payment the user had just sent, so it never reached the Bitcoin network.
- Show the user a fake payment in its place, sending the same coins to the attacker’s address. The fake was often made with no fee, so it looked “stuck”.
- Wait for the user to press “increase fee” (known as Replace-by-Fee) to speed it up.
At that point Electrum signed a new, valid transaction based on the fake one, and the coins went to the attacker. To make the switch harder to notice, the attacker’s address ended in the same last four characters as the real one.
Timeline
- October 11: a first user privately reports a strange transaction in their history.
- October 18: a second user reports losing money after raising a fee.
- October 23: the fix is prepared.
- October 24: Electrum 4.8.3 is released and the bug is made public.
What Electrum users should do
- Update to version 4.8.3 or later, downloaded only from the official Electrum website.
- Check the full address and amount before you sign any transaction, including a fee bump. Don’t rely on the first or last few characters.
- If a payment you just sent looks different in your history, don’t bump it. Check the transaction on a block explorer first.
You can read more about the wallet itself in our Electrum review.
Why it matters
Electrum has been around since 2011 and is used by many long-term Bitcoin holders. The attack needed no malware on the user’s computer, only a dishonest server and one routine click. It is a reminder that light wallets depend on the servers they talk to, and that checking the full address before signing is the last line of defense.
This article is for information only and is not financial advice.
