Electrum patches critical flaw allowing server injection of fake Bitcoin transactions

Electrum released version 4.8.3 on October 24 to patch a high-severity vulnerability that allowed malicious servers to inject fake transactions and redirect user funds to attacker-controlled addresses. The flaw affects all versions prior to 4.8.3. At least one user confirmed losing funds on October 18 after fee-bumping a server-manipulated transaction. The fix verifies cryptographic signatures on wallet-owned inputs before displaying unconfirmed transactions, though incoming transactions from external senders remain unverified.