Electrum 4.8.3 Fixes Flaw Tied to Redirected Bitcoin Payments

Electrum has shipped version 4.8.3 to close a high-risk vulnerability that allowed malicious servers to divert Bitcoin payments at the moment a user tried to raise a transaction fee. The wallet maker urged all users to upgrade immediately after the fix was released on Saturday, Coincentral reported.

The flaw affected every release before 4.8.3 and was catalogued as GitHub advisory GHSA-6jp4-8v48-cc5v, with the patch arriving through commit 90fe308. News.bitcoin reported that Electrum confirmed a user had lost funds after approving a fee increase, a case that showed the attack was not merely theoretical.

Key facts

• Electrum 4.8.3, released on Saturday, fixes a high-risk flaw in all earlier versions and tells users to update from electrum.org.
• The bug is tracked as advisory GHSA-6jp4-8v48-cc5v and was fixed in commit 90fe308.
• Two private reports reached developers: dannydeezy on Oct. 11 reported transaction substitution, and Raju-K12 on Oct. 18 reported funds lost after approving a fee increase.
• Attackers generated addresses whose last four characters matched the intended recipient, per both accounts.
• One fraudulent transaction carried a zero fee, which may have nudged the victim toward starting a fee bump.

How a fee bump became a theft

Electrum leans on outside servers for transaction histories, fee estimates and payment broadcasts, while checking confirmed transactions itself. Older versions accepted some unconfirmed transactions without verifying their signatures, and attackers used that gap.

A compromised server could block a genuine payment from being broadcast and insert a fake transaction sending coins to an attacker-controlled address. The substitute carried invalid signatures but appeared in the wallet as an ordinary pending payment, News.bitcoin reported. The trap closed when the user tried to raise the fee through Replace-by-Fee: rather than bumping the original payment, the user could sign the fake one and authorise the transfer.

The matching final four characters of the attacker’s address made a quick visual check less likely to catch the switch. News.bitcoin noted that the design contrast is awkward — a wallet built to protect private keys could still be manipulated into requesting a valid signature for a payment its owner never meant to make.

What the patch changes

Version 4.8.3 requires Electrum to check signatures on unconfirmed transactions that spend the wallet’s coins. Fraudulent transactions with invalid signatures are rejected before they reach the wallet’s local history.

Until they upgrade, users should inspect every destination address and amount before signing, including when adjusting fees. Electrum said people who connect only to trusted, self-hosted servers are not exposed to this server-based attack. The developers said a full description of the vulnerability would be published later the same day, and warned that Windows Defender may flag ZXing.dll as a false positive.

Why it matters

The episode turns on a feature most users treat as routine: bumping a stuck transaction. Anyone running an older Electrum build and connected to a public server was in the path of the attack until they updated. Because the deceptive transaction looked like a normal pending payment, the ordinary habit of checking an address by its first and last characters was not enough protection.

What to watch

The next concrete marker is Electrum’s promised full write-up of the vulnerability, which the project said would be published after the release. Users should also confirm they are running 4.8.3 and that the installer was downloaded from electrum.org with its signatures verified.

Disclaimer: This article is for information only and is not investment, financial or trading advice. Cryptocurrency prices are highly volatile. Always do your own research.

Sources: CoinCentral, News.bitcoin