Bitcoin Wallet Electrum Fixes Fee-Increase Theft Vulnerability

Bitcoin light wallet Electrum disclosed on October 24 a malicious server attack targeting transaction fee increases, fixed in version 4.8.3, corresponding to GitHub security advisory GHSA-6jp4-8v48-cc5v. When users performed routine fee bumps on transactions, they could sign funds over to an attacker. Developers said the issue stemmed from user reports of losing funds after signing fee increases. Two reports had different outcomes: one person, after broadcasting a payment, found the transaction in their wallet history replaced, claiming the original payment never entered the Bitcoin peer-to-peer network and was withheld by the server; another, Raju-K12, fee-bumped the replaced transaction and lost funds. In the attack, a malicious server withheld newly broadcast transactions from clients and inserted a conflicting transaction into history, swapping the original output for an attacker-controlled address. The replacement transaction had an invalid signature at the time, but light clients did not verify these signatures before displaying unconfirmed transactions; when users manually fee-bumped via RBF and signed, the attacker's payment became effective. Both individuals stated the attacker's address shared the same last four characters as the legitimate recipient address. The advisory did not disclose the stolen amount, transaction identifiers, or the attacker's address. The patch corresponds to commit 90fe308, which verifies signatures on the wallet's own inputs before writing mempool transactions to local history, but does not cover inputs from addresses outside the wallet or perform full consensus validation. The advisory recommends unupgraded users verify output addresses and amounts on every signature; clients connected to their own or trusted servers are unaffected by this attack. Timeline: first privately disclosed on October 11, fee-loss report received on October 18, fixed version tagged on October 23, with binaries and public disclosure on October 24.