Electrum Discloses High-Severity Flaw Exploited in the Wild, With User Funds Lost

Source: PANews2026/10/25 04:22

Analysis

The Electrum disclosure shifts a long-standing wallet-trust assumption: the risk here is not a broken signature scheme but a malicious server manipulating the transaction history a user sees, so a legitimate fee-bump (RBF) action becomes the signing step that funds the attacker. Confirmed elements are the high-severity advisory covering all versions before 4.8.3, in-the-wild exploitation by some servers, and two reported cases with one confirmed loss; the amount remains undisclosed. The transmission path is narrow but sharp, hitting users on public or third-party servers who raise fees without re-verifying the recipient, while self-hosted server users are unaffected. Watch whether the Electrum team publishes server blacklists or detection tooling, whether other lightweight wallets with similar history-rendering designs audit their RBF flows, and whether the two reported cases grow into a broader tally of losses.

If you have any feedback or questions about this content, please contact us at crypto.news@kcex.com

PANews, October 25: Bitcoin wallet Electrum posted on X detailing the vulnerability fixed in version 4.8.3. According to its GitHub security advisory, the flaw is high-severity and affects all versions prior to 4.8.3: a malicious Electrum server can intercept a transaction the user has just broadcast and replace it in the wallet history with a conflicting transaction paying an attacker's address; if the user applies RBF to raise the fee on that transaction, the wallet will sign the transaction and send the funds to the attacker. Electrum said some servers have already carried out this attack in the wild, and two users have so far reported related cases, one of whom lost funds by raising the fee; the specific amount was not disclosed. The official recommendation is for users to upgrade to version 4.8.3, and before upgrading, to verify the recipient address and amount when signing any transaction (including fee bumps). Users connecting to their own servers are not affected.

Disclaimer: The articles reposted on this website are sourced from public platforms and are for reference only. These articles do not represent the views or opinions of KCEX. All copyrights belong to the original authors. If you believe that any reposted article infringes upon the rights of a third party, please contact crypto.news@kcex.com for removal. KCEX makes no representations or warranties regarding the timeliness, accuracy, or completeness of reposted articles, and shall not be liable for any actions or decisions made based on such content. Reposted materials are for informational purposes only and do not constitute advice, endorsement, or basis for any commercial, financial, legal, and/or tax decisions.