Electrum wallet: malicious servers swap just-sent transactions and trick users into fee-bumping a payment to the attacker ยท updates https://pwn.watch/i/electrum-malicious-server-rbf-fee-bump-theft Electrum before 4.8.3 trusted its server for unconfirmed transactions without checking their signatures. A malicious Electrum server can swallow a transaction the user just broadcast and show a conflicting fake (with invalid signatures) that pays an attacker address ground to match the last four characters of the real one. If the user then bumps the fee with Replace-By-Fee, the wallet signs a valid payment to the attacker. Electrum says some servers are doing this in the wild, and one user lost money. Upgrade to Electrum 4.8.3; until then, check every output address and amount before signing, including fee bumps. Users connecting only to a server they run or trust are not affected. en Sat, 24 Oct 2026 00:00:00 GMT Electrum wallet: malicious servers swap just-sent transactions and trick users into fee-bumping a payment to the attacker: Electrum 4.8.3 binaries released and GHSA-6jp4-8v48-cc5v published; the client now verifies signatures of its own inputs in mempool transactions. https://pwn.watch/i/electrum-malicious-server-rbf-fee-bump-theft https://pwn.watch/i/electrum-malicious-server-rbf-fee-bump-theft#2026-10-24-066138a8 Sat, 24 Oct 2026 00:00:00 GMT high <p><a href="https://github.com/spesmilo/electrum/security/advisories/GHSA-6jp4-8v48-cc5v">Source</a></p> Electrum wallet: malicious servers swap just-sent transactions and trick users into fee-bumping a payment to the attacker: Second private report: a user loses funds after fee-bumping the substituted transaction. https://pwn.watch/i/electrum-malicious-server-rbf-fee-bump-theft https://pwn.watch/i/electrum-malicious-server-rbf-fee-bump-theft#2026-10-18-794de252 Sun, 18 Oct 2026 00:00:00 GMT high <p><a href="https://github.com/spesmilo/electrum/security/advisories/GHSA-6jp4-8v48-cc5v">Source</a></p> Electrum wallet: malicious servers swap just-sent transactions and trick users into fee-bumping a payment to the attacker: First private report: a user sees a different transaction in their wallet history after broadcasting. https://pwn.watch/i/electrum-malicious-server-rbf-fee-bump-theft https://pwn.watch/i/electrum-malicious-server-rbf-fee-bump-theft#2026-10-11-3a5105fc Sun, 11 Oct 2026 00:00:00 GMT high <p><a href="https://github.com/spesmilo/electrum/security/advisories/GHSA-6jp4-8v48-cc5v">Source</a></p>