Bitcoin wallet bug let rogue servers steal funds when users tried to speed up payments
Attackers replaced legitimate transactions with fake ones, then waited for users to approve higher fees. At least one person lost bitcoin before developers patched the flaw.
Make preferred on
Share this article
Summary
- A flaw in Electrum allowed malicious servers to substitute fake pending Bitcoin transactions that users could unknowingly authorize when using Replace-by-Fee, with at least one theft confirmed.
- Electrum released version 4.8.3 on Oct. 24 to verify signatures on relevant unconfirmed transactions, but earlier versions remain vulnerable when connected to malicious servers.
- Users should upgrade Electrum and carefully verify payment addresses and amounts before signing transactions; those using only trusted servers, including their own, were not exposed.
