Electrum patches Bitcoin wallet flaw after server attacks

Electrum, one of the oldest Bitcoin (BTC) wallets, released version 4.8.3 on 24 October 2026 to fix a flaw that let a hostile server trick users into signing a payment to an attacker. The project urged every user to upgrade.

That warning comes from Electrum's own security advisory, numbered GHSA-6jp4-8v48-cc5v and published on 24 October. It rates the flaw high severity and says plainly that some servers were already running the attack.

How the attack worked

Two things had to line up for the theft to work: a malicious server, and a manual fee increase by the wallet owner.

Like other light wallets, Electrum does not run a full Bitcoin node. It leans on separate Electrum servers for its view of the blockchain. That design keeps the wallet small and fast, but it also means the server a user picks decides what the wallet sees.

When a user broadcast a payment, a hostile server could hide that transaction and show a conflicting one in its place. The fake version redirected the coins to the attacker. Older builds of Electrum showed it as unconfirmed and never checked whether its signatures were real.

The trap sprang on the fee. If the owner tried to speed the payment up with replace-by-fee, a standard Bitcoin feature that raises a stuck transaction's fee, the wallet signed the attacker's version instead. In both cases reported to the project, the fake address had been ground to match the last four characters of the real one, the part many people glance at.

Who was exposed, and who was not

Not every Electrum user was at risk. Wallets pointed at a trusted server, such as one the owner runs, were never exposed, because the attack depends on the server lying to the client. The default of connecting to public servers chosen at random is what opened the door.

By the project's own account, the main server a client connects to is trusted with unconfirmed transactions. So the flaw sat in how that trust was handled, not in a hidden backdoor.

This was not a break in Bitcoin itself. The coins were safe. The weak point sat in the trust between a wallet and the server feeding it data, the same trust a self-custody wallet hands to its owner.

Other wallets moved quickly. Francis Pouliot, chief executive of Bull Bitcoin, said his wallet connects by default only to its own two servers and one run by Blockstream, so users were safe unless they had manually picked a compromised server. "Nevertheless, we are immediately adding a client-side validation using the same approach as Electrum wallet," Pouliot said.

What Electrum changed, and when

The fix is narrow. Version 4.8.3 now checks the signatures on a wallet's own inputs before it adds an unconfirmed transaction to its records, so a forged one no longer slips through. Transactions the wallet does not control are still left unverified, which the advisory notes.

Electrum first learned of the problem on 11 October 2026, when one user reported it without the fee-bump twist. A second user came forward on 18 October after losing money to a fee bump. Electrum tagged 4.8.3 on 23 October and shipped the binaries, with the public disclosure, on 24 October. No CVE was assigned.

What to watch

Anyone running a version of Electrum older than 4.8.3 should move to the new release. Until then, the safer habit is to read the full destination address and amount before signing anything, including a fee increase, rather than trusting the last few characters. Electrum repeated its standing advice to download only from electrum.org and to verify the GPG signature, a step that also guards against the tampered hardware wallets that drained funds this month.

What stays unclear is the scale. Electrum has not put a number on total losses or said how many people were hit. Two reports. That was all it had confirmed when it went public.