Electrum patches flaw that let malicious servers swap in fake transactions

Bitcoin software wallet Electrum released security update 4.8.3 on Oct. 24 and disclosed a vulnerability that let malicious servers hijack users' outgoing payments. In a GitHub security advisory, the developers said "some servers are performing this attack in the wild" and urged users to upgrade. The flaw is rated high severity and affects all versions below 4.8.3.

The real payment vanishes, a fake one shows as pending

Electrum is a lightweight wallet that does not download the full Bitcoin blockchain. Instead, it connects to Electrum servers to fetch the transaction history of its addresses. The wallet verifies transactions that have been included in blocks, but it relies on the server for unconfirmed transactions that have not yet been mined. The developers have long stated this in the official FAQ: "The server is trusted about unconfirmed transactions."

According to the FAQ, Electrum normally keeps connections to around 10 servers, but uses most of them only for block headers and fee estimates. A single "main" server, chosen arbitrarily, fetches the wallet's history and broadcasts the transactions the user creates. A malicious main server therefore controls both what gets broadcast and what the wallet displays.

The attack exploited that gap. When a user sends a payment, the malicious server holds the transaction instead of relaying it to the Bitcoin network. It then pushes a fake transaction into the wallet's history, identical except that the destination is swapped for the attacker's address. The fake transaction has invalid signatures and cannot be broadcast as a valid transaction, but the wallet did not check them and displayed it as unconfirmed. The original payment disappears from view.

Bumping the fee adds a real signature

The danger comes next. When a transaction stays unconfirmed, users typically resend it with a higher fee using Replace-by-Fee (RBF). Electrum then builds the new transaction from the fake one on screen, and this time signs it correctly with the user's key. What the user believes is a simple fee bump becomes a valid transaction sending coins to the attacker.

Both users who reported the issue said the attacker's address had the same last four characters as the intended recipient's address, targeting users who check only the end of an address. In the case of the user who lost money, the fake transaction built by the server paid zero fee, which the developers said was presumably meant to get the user to bump it. The developers did not disclose the amount lost or identify the attacking servers.

The first user who reported the issue said the original transaction was never propagated to the Bitcoin network, indicating that the server had withheld it. According to CoinDesk, that user was using a 2-of-3 multisig wallet (one that requires two of three signatures to move funds) built with two Trezor hardware wallets, and did not report losing funds.

1. Oct. 11First report: a different transaction appeared in the wallet history right after sending. The fee-bump theft vector was not yet recognized
2. Oct. 18Second report: a user (Raju-K12) privately reported losing money after bumping the fee on the fake transaction
3. Oct. 23Version 4.8.3 tagged with the fix
4. Oct. 24Version 4.8.3 installers released and the security advisory published

A gap remains after the patch

Starting with 4.8.3, Electrum checks signatures on unconfirmed transactions that spend from the wallet's own addresses before adding them to its history. Fake transactions with invalid signatures no longer appear in the wallet. The developers noted, however, that only transactions spending from the wallet's own addresses are checked. Unconfirmed incoming payments from others are still not validated. Transactions already in blocks continue to be verified by the wallet as before.

Version 4.8.3 is available for Windows, macOS and Linux, as well as Android. The previous version, 4.8.2, was released on Sept. 12. The release notes classify 4.8.3 as a security update and credit four people who reported security issues, including Raju-K12, although this is the only security advisory listed in the release notes. The update also includes stricter validation of plugin metadata, stricter Lightning invoice parsing and a new command (dscancel) that cancels an unconfirmed transaction by double-spending it.