A flaw in Electrum let malicious servers swap in fake pending Bitcoin transactions when users tried to raise fees. Developers confirmed at least one user lost funds; some servers were reportedly already exploiting the bug.

  • Electrum relied on outside servers for transaction data and failed to verify signatures on relevant unconfirmed transactions.
  • Attackers could replace a payment in the wallet’s history with a fake transaction directing coins to their address.
  • Version 4.8.3, released Oct. 24, fixes the flaw; older versions remain vulnerable when connected to malicious servers.

This is a direct wallet-risk event, not a protocol-level Bitcoin exploit. Upgrade now, verify every address and amount before signing, and use trusted servers; fee-bumping should never be a blind click.