Electrum wallet bug allowed rogue servers to steal funds via Replace-by-Fee

A vulnerability in Electrum allowed malicious servers to substitute fake pending Bitcoin transactions, tricking users into authorizing payments to attackers when using Replace-by-Fee. At least one confirmed theft occurred, affecting users on older versions connected to malicious servers. Electrum released version 4.8.3 on Oct. 24 to fix signature verification, but earlier versions remain vulnerable. Users are advised to upgrade and verify payment addresses and amounts before signing.