A security vulnerability in the Electrum Bitcoin wallet allowed attackers to manipulate pending transactions and redirect users’ bitcoin to fraudulent addresses when they tried to speed up payments. Developers confirmed at least one theft linked to the flaw before releasing a patch.

Electrum, a veteran wallet in the Bitcoin ecosystem, disclosed the issue on Saturday, warning that malicious servers had already exploited the weakness. The development team received two reports in October, one of which involved a user who lost funds after approving what appeared to be a standard transaction-fee increase.

The flaw stemmed from the way Electrum handled Bitcoin payments awaiting network confirmation.

Unlike a full Bitcoin node, Electrum depends on external servers to retrieve transaction data and broadcast payments. Before the fix, the wallet did not validate signatures on server-reported unconfirmed transactions.

An attacker controlling a malicious server could take advantage of this gap by intercepting a payment before it reached the Bitcoin network and replacing the transaction shown in Electrum with a fraudulent one. The fake transaction directed the user’s coins to an address controlled by the attacker, despite containing invalid signatures that the wallet failed to recognize.

Electrum continued to display the substituted payment as pending, setting up the next stage of the attack. When users attempted to accelerate the transaction, they risked authorizing the fraudulent payment.

Bitcoin’s Replace-by-Fee (RBF) feature allows users to replace an unconfirmed transaction with another carrying a higher fee. In the vulnerable Electrum versions, selecting this option could cause the wallet to sign a replacement transaction that transferred the funds to the attacker’s address.

One reported attack involved a fraudulent transaction with no fee, making the payment appear stalled and prompting the user to increase the fee. Attackers also created destination addresses with the same final four characters as the legitimate recipient’s address, making the change harder to spot during a quick review.

The first report was submitted on October 11 and involved a two-of-three multisignature wallet protected by two Trezor hardware devices. Although the user checked the intended payment on both devices, a different outgoing transaction later appeared in Electrum’s history. No loss of funds was reported in this incident.

A second user reported the issue on October 18 after increasing the fee on a substituted transaction and losing bitcoin. Developers have not disclosed the amount stolen or identified the servers involved.

Electrum Releases a Fix for the Security Flaw

Electrum issued version 4.8.3 on October 24, introducing signature checks for unconfirmed transactions that spend coins from the user’s own wallet.

Users running older versions may remain exposed when connecting to malicious servers.

The development team recommends upgrading to the patched version and verifying recipient addresses and transaction amounts before signing payments. According to the developers, users who connected only to trusted servers, including their own, were not affected by this particular attack.

The patch arrived six days after the first reported incident, highlighting the potential risks of relying on external servers to process Bitcoin transaction information without adequate verification.