Electrum patches wallet flaw that let malicious servers steal bitcoin during fee bumps

Electrum is among Bitcoin’s oldest software wallets, and a flaw in how it handled pending payments let rogue servers redirect users’ funds during routine fee bumps. For anyone holding bitcoin in a lightweight wallet, the incident shows that the choice of server, and a check before signing, can decide whether coins are lost.

• Electrum version 4.8.3, released Oct. 24, adds signature checks for unconfirmed transactions spending the user’s own coins.
• Developers received two reports in October, and one user lost funds after approving a routine-looking fee increase.
• Versions before 4.8.3 stay vulnerable on malicious servers, while users connected only to trusted servers were not exposed.

• 4.8.3 Electrum release adding signature checks, while earlier versions remain vulnerable to the attack
• 6 days Gap between the Oct. 18 theft report and the Oct. 24 fix
• 2 User reports received in October, only one involving lost funds
• 4 Final address characters spoofed to match the real destination, defeating quick checks

CoinDesk reported that Electrum disclosed on Saturday a vulnerability that let malicious servers trick users into signing payments to attackers. The trigger was an attempt to speed up a transaction. Developers confirmed at least one case in which money was stolen and said some servers were already exploiting the flaw.

The patch is out, but it only helps users who install it, and earlier versions stay exposed to malicious servers as of today, Monday (October 26).

Fake pending transactions slipped past Electrum because it skipped signature checks

Unlike a full Bitcoin node, Electrum relies on outside servers to retrieve transaction histories and broadcast payments. Before the fix, the wallet trusted those servers to report pending transactions without verifying their signatures.

An attacker controlling one of those servers could intercept a payment before it reached the Bitcoin network. The attacker then swapped it in the wallet’s history for a fake transaction. That replacement sent the user’s coins to an attacker-controlled address and carried invalid signatures that Electrum failed to detect.

The wallet then displayed the fake payment as pending, and the trap closed when users tried to speed things up.

Replace-by-Fee turned a stuck payment into a valid theft

Bitcoin allows unconfirmed transactions to be replaced with versions carrying higher fees, a feature called Replace-by-Fee. If a user selected that option, Electrum could take the fraudulent transaction and sign a valid replacement. The coins then went to the attacker.

In one reported case, the malicious transaction carried no fee at all, which made it look stuck and invited a fee increase. Attackers also generated receiving addresses whose last four characters matched the legitimate destination. That made the substitution harder to catch in a quick check.

Electrum 4.8.3 arrived six days after the first reported theft

The first report, submitted Oct. 11, involved a two-of-three multisignature wallet using two Trezor hardware devices. The user had checked the legitimate payment on both devices but later noticed a different outgoing transaction in the wallet’s history. That user did not report losing funds.

A second user reported on Oct. 18 that they had raised the fee on a substituted transaction and lost money. Developers have not disclosed the amount stolen or identified the malicious servers.

Electrum laid out the issue in a security advisory. Version 4.8.3, released Oct. 24, adds signature checks for unconfirmed transactions that spend coins from the user’s own wallet. Earlier versions remain vulnerable to the reported attack when connected to malicious servers, and developers recommend upgrading and checking receiving addresses and amounts before signing.

Users connected only to servers they trust, including their own, were not exposed to this attack.

The operators of the malicious servers are not identified, and neither they nor Trezor, whose devices the first user relied on, are represented in the reporting.

The BlockWest read. We read the exposure as a question of which server a wallet trusts, not how coins are held. The first user’s two-of-three setup with two Trezor devices still showed a substituted transaction in its history. Holders of bitcoin in light wallets should treat server choice and address checks before signing as working controls, because the fix protects only those who upgrade.

Electrum’s developers have not said how much was stolen or which servers were involved, and both disclosures remain open. Until users move to version 4.8.3, anyone on an earlier release who connects to a malicious server stays exposed.

BlockWest is a news publication. Nothing here is investment advice. Read our disclaimer and editorial policy.