# Electrum wallet: malicious servers swap just-sent transactions and trick users into fee-bumping a payment to the attacker · pwn.watch > Electrum before 4.8.3 trusted its server for unconfirmed transactions without checking their signatures. A malicious Electrum server can swallow a transaction the user just broadcast and show a conflicting fake (with invalid signatures) that pays an attacker address ground to match the last four characters of the real one. If the user then bumps the fee with Replace-By-Fee, the wallet signs a valid payment to the attacker. Electrum says some servers are doing this in the wild, and one user lost money. Upgrade to Electrum 4.8.3; until then, check every output address and amount before signing, including fee bumps. Users connecting only to a server they run or trust are not affected. Page: https://pwn.watch/i/electrum-malicious-server-rbf-fee-bump-theft · generated 2026-10-25T07:47:00.659Z ## Status - Severity: high · status: live · patch: patched - Product: Electrum Bitcoin wallet - Started: 2026-10-24 - Affected: Electrum < 4.8.3 - Fixed in: Electrum 4.8.3 ## Follow this incident - RSS (one item per update): https://pwn.watch/i/electrum-malicious-server-rbf-fee-bump-theft/feed.xml - JSON Feed: https://pwn.watch/i/electrum-malicious-server-rbf-fee-bump-theft/feed.json - Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/electrum-malicious-server-rbf-fee-bump-theft.json - This file: https://pwn.watch/i/electrum-malicious-server-rbf-fee-bump-theft/llms.txt ## Updates (newest first) - 2026-10-24: Electrum 4.8.3 binaries released and GHSA-6jp4-8v48-cc5v published; the client now verifies signatures of its own inputs in mempool transactions. (https://github.com/spesmilo/electrum/security/advisories/GHSA-6jp4-8v48-cc5v) - 2026-10-18: Second private report: a user loses funds after fee-bumping the substituted transaction. (https://github.com/spesmilo/electrum/security/advisories/GHSA-6jp4-8v48-cc5v) - 2026-10-11: First private report: a user sees a different transaction in their wallet history after broadcasting. (https://github.com/spesmilo/electrum/security/advisories/GHSA-6jp4-8v48-cc5v) ## Fix brief # Security brief: Electrum wallet: malicious servers swap just-sent transactions and trick users into fee-bumping a payment to the attacker Source: https://pwn.watch/i/electrum-malicious-server-rbf-fee-bump-theft · status: live · severity: high · updated Oct 25, 2026, 06:25 UTC ## Patch status **PATCHED: fixed releases exist. Upgrade to a fixed version.** ## What it is Electrum before 4.8.3 trusted its server for unconfirmed transactions without checking their signatures. A malicious Electrum server can swallow a transaction the user just broadcast and show a conflicting fake (with invalid signatures) that pays an attacker address ground to match the last four characters of the real one. If the user then bumps the fee with Replace-By-Fee, the wallet signs a valid payment to the attacker. Electrum says some servers are doing this in the wild, and one user lost money. Upgrade to Electrum 4.8.3; until then, check every output address and amount before signing, including fee bumps. Users connecting only to a server they run or trust are not affected. Severity detail: Electrum rates it sev-high; exploited in the wild by malicious servers, one confirmed loss - Product: Electrum Bitcoin wallet ## Affected versions - Electrum < 4.8.3 ## Check whether you're affected No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above. ## Fix Upgrade to one of these fixed versions (or later on the same branch): - Electrum 4.8.3 After upgrading, re-run the checks above and redeploy/restart the affected services. ## Specific notes If someone uses Electrum below 4.8.3, tell them to upgrade to 4.8.3 from the official site and verify the signature; until then, check every output address and amount in full before signing or fee-bumping, and do not bump a just-sent payment whose address changed. ## Latest updates - Oct 24, 2026: Electrum 4.8.3 binaries released and GHSA-6jp4-8v48-cc5v published; the client now verifies signatures of its own inputs in mempool transactions. - Oct 18, 2026: Second private report: a user loses funds after fee-bumping the substituted transaction. - Oct 11, 2026: First private report: a user sees a different transaction in their wallet history after broadcasting. ## Advisories - [GHSA-6jp4-8v48-cc5v: Malicious server can replace a just-broadcast tx and try to trick user into RBF-ing it](https://github.com/spesmilo/electrum/security/advisories/GHSA-6jp4-8v48-cc5v) (spesmilo/electrum) - [Electrum release notes (4.8.3 security update)](https://raw.githubusercontent.com/spesmilo/electrum/refs/heads/master/RELEASE-NOTES) (spesmilo/electrum) ## Write-ups & news - [Electrum Wallet Attack Hid Bitcoin Theft Behind a Fee Increase](https://news.bitcoin.com/security/electrum-wallet-attack-hid-bitcoin-theft-behind-a-fee-increase/) - [Electrum Patches Wallet Flaw Exploited Through Malicious Servers](https://thedefiant.io/news/security/electrum-patches-wallet-flaw-exploited-through-malicious-servers) --- Machine-readable: https://pwn.watch/i/electrum-malicious-server-rbf-fee-bump-theft.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.