Electrum
Security incidents tagged Electrum. Newest first.
1 Electrum incident in the last 12 months
- Incidents
- 1
- Live
- 1
- Patched
- 1
- Days without an incident
- 1
- Longest quiet run: 6 days (Oct 12–Oct 17)
- Patched
Electrum wallet: malicious servers swap just-sent transactions and trick users into fee-bumping a payment to the attacker
Electrum before 4.8.3 trusted its server for unconfirmed transactions without checking their signatures. A malicious Electrum server can swallow a transaction the user just broadcast and show a conflicting fake (with invalid signatures) that pays an attacker address ground to match the last four characters of the real one. If the user then bumps the fee with Replace-By-Fee, the wallet signs a valid payment to the attacker. Electrum says some servers are doing this in the wild, and one user lost money. Upgrade to Electrum 4.8.3; until then, check every output address and amount before signing, including fee bumps. Users connecting only to a server they run or trust are not affected.
Electrum Bitcoin walletSince Oct 24, 2026
