Electrum Confirmation: 4.8 The high-severity vulnerability in versions before.3 has been exploited in the wild, and users have already lost funds

AT A GLANCE

Electrum Disclosed that a high-severity vulnerability has been exploited in the wild, with users losing funds after increasing transaction fees.

Article

Electrum Discloses a high-severity vulnerability exploited in the wild; user funds have already been lost

PANews October 25 reported that the Bitcoin wallet Electrum posted on X, disclosing 4.8 details of the vulnerability fixed in version.3. According to its GitHub security advisory, the vulnerability is rated high severity and affects 4.8 all versions prior to.3: a malicious Electrum server can intercept a transaction just broadcast by a user and replace it in the wallet history with a conflicting transaction paying an attacker-controlled address. If the user uses RBF to increase the transaction fee, the wallet will sign the transaction and send funds to the attacker.Electrum said that some servers have already carried out this attack in the wild. Two users have currently reported related incidents, one of whom lost funds after increasing the transaction fee; the specific amount was not disclosed. Officials advise users to upgrade to version 4.8.3. Before upgrading, users must verify the recipient address and amount when signing any transaction, including when increasing the transaction fee. Users connected to self-hosted servers should...

Key points

Electrum disclosed 4.8 details of the vulnerability fixed in version.3.
The vulnerability is rated high severity and affects 4.8 all versions prior to.3.
A malicious Electrum server can intercept a transaction just broadcast by a user and replace it with a conflicting transaction paying an attacker-controlled address.
If a user uses RBF to increase the transaction fee, the wallet will sign the transaction and send funds to the attacker.
Electrum said that some servers have already carried out this attack in the wild.
Two users have currently reported related incidents, one of whom lost funds after increasing the transaction fee.
Officials advise users to upgrade to 4.8 version.3; before upgrading, users must verify the recipient address and amount when signing transactions.

AI-assisted interpretation

The following is analysis, separate from reported facts. Verify important claims independently.

Simply put, older wallet versions may display a replaced transaction. If users directly use RBF to increase the fee, they may sign a transaction that transfers funds to an attacker.

Why it matters to readers

This affects older-version Electrum users' fund security when signing Bitcoin transactions.

If you use an older version of Electrum, carefully verify the recipient address and amount when signing transactions or increasing transaction fees before upgrading.

Risks and unknowns

The specific amount of losses has not yet been disclosed.
The report did not specify the number of servers carrying out the attack.
The scope of affected users and subsequent losses remain unclear.
The source text provided is incomplete at the recommendation concerning self-hosted servers.

Electrum Confirmation: 4.8 The high-severity vulnerability in versions before.3 has been exploited in the wild, and users have already lost funds

Article

AI-assisted interpretation

Why it matters to readers

Risks and unknowns

Related Developments

Related concepts

Keep following

Security Center