Electrum Wallet Replace-by-Fee Vulnerability Enables Fund Theft
Current overview (not historical)
Electrum wallet's Replace-by-Fee mechanism has a signature verification flaw that allows malicious servers to forge unconfirmed transactions and induce users to sign, resulting in fund theft. The vulnerability was exploited at least once before Electrum released version 4.8.3 on October 24 to fix the signature verification. Earlier versions remain vulnerable when connecting to malicious servers. Security researchers from CoinDesk, CryptoSlate, and Decrypt reported that hackers exploited the flaw to redirect funds without private keys.
Written with AI from the reporting · updated 10/26/2026
Expand the detailed fact route and sources
Story route
A station-by-station route from the first public evidence onward; every station carries its own evidence and uncertainty.
- 1Unclassified fact stationOct 26, 00:00recorded Oct 26, 13:18single sourcerevised
Electrum钱包漏洞导致伪服务器窃取资金
Read original source ↗ CoinDeskReplay this moment in the explorerEvidence & revisions · 1 source records
- Subject：
- electrum
- Action：
- 漏洞被利用
- Object：
- 用户资金
- Occurred (fact side)：
- Oct 26, 00:00
- Published (valid side)：
- Oct 26, 13:15
- First seen (known side)：
- Oct 26, 13:18
Fact stationSingle source · one-sided claimRevisedCopy may have been revised later; time replay is bounded. Layer labels group reading only, not causation between layers.
- 2Unclassified fact stationOct 23, 00:00recorded Oct 26, 17:33single sourcerevised
Electrum 4.8.3 发布修复 Bitcoin 支付劫持漏洞
Read original source ↗ CryptoSlateReplay this moment in the explorerEvidence & revisions · 1 source records
- Subject：
- electrum
- Action：
- 发布安全更新 4.8.3
- Object：
- 修复交易费用劫持漏洞
- Occurred (fact side)：
- Oct 23, 00:00
- Published (valid side)：
- Oct 26, 17:30
- First seen (known side)：
- Oct 26, 17:33
Fact stationSingle source · one-sided claimRevisedCopy may have been revised later; time replay is bounded. Layer labels group reading only, not causation between layers.
- 3Unclassified fact stationOct 24, 00:00recorded Oct 27, 02:02single sourcerevised
Electrum 4.8.3 发布修复高危漏洞
Read original source ↗ DecryptReplay this moment in the explorerEvidence & revisions · 1 source records
- Subject：
- electrum
- Action：
- 发布安全补丁
- Object：
- 修复服务器注入伪造交易漏洞
- Occurred (fact side)：
- Oct 24, 00:00
- Published (valid side)：
- Oct 27, 01:41
- First seen (known side)：
- Oct 27, 02:02
Fact stationSingle source · one-sided claimRevisedCopy may have been revised later; time replay is bounded. Layer labels group reading only, not causation between layers.
Uncertainty marks flag where to check the sources; they are not proven causation.
Report timeline
Explore every side through dated source reports.
- DecryptRelated fact: single sourceSource report revisedElectrum patches critical flaw allowing server injection of fake Bitcoin transactions
Report first recorded Oct 27, 02:02
Electrum released version 4.8.3 on October 24 to patch a high-severity vulnerability that allowed malicious servers to inject fake transactions and redirect user funds to attacker-controlled addresses. The flaw affects all versions prior to 4.8.3. At least one user confirmed losing funds on October 18 after fee-bumping a server-manipulated transaction. The fix verifies cryptographic signatures on wallet-owned inputs before displaying unconfirmed transactions, though incoming transactions from external senders remain unverified.
Read original source ↗
- CryptoSlateRelated fact: single sourceSource report revisedElectrum patched critical vulnerability exploited to redirect Bitcoin payments
Report first recorded Oct 26, 17:33
Security researchers discovered a high-severity flaw in Electrum Bitcoin wallet that allowed malicious servers to redirect payments during fee adjustments. The vulnerability, patched in version 4.8.3, exploited the wallet's reliance on external servers to display manipulated transaction details. Attackers generated addresses matching the final four characters of legitimate recipients, deceiving users who checked partial addresses. At least one user lost funds after approving a fraudulent transaction. The exploit leveraged Bitcoin's Replace-by-Feature mechanism, requiring users to manually increase fees to trigger the attack.
Read original source ↗ - CoinDeskRelated fact: single sourceSource report revisedElectrum wallet bug allowed rogue servers to steal funds via Replace-by-Fee
Report first recorded Oct 26, 13:18
A vulnerability in Electrum allowed malicious servers to substitute fake pending Bitcoin transactions, tricking users into authorizing payments to attackers when using Replace-by-Fee. At least one confirmed theft occurred, affecting users on older versions connected to malicious servers. Electrum released version 4.8.3 on Oct. 24 to fix signature verification, but earlier versions remain vulnerable. Users are advised to upgrade and verify payment addresses and amounts before signing.
Read original source ↗
Event activity trend
- Latest comparable
- 3
- Comparable peak
- 6Oct 28, 14:00
- 24h change
- –
The chart compares consistently observed participants only. Hover or tap to inspect each hour; use arrow keys to move between observations.
Event discussion
Reader opinions are hosted on GitHub Discussions; posting requires a GitHub account. Comments are not verified facts.