Electrum Warns of Exploited Wallet Flaw in Versions Before 4.8.3

Electrum warned that attackers are exploiting a vulnerability in Bitcoin (BTC) wallet releases before 4.8.3, where a fee increase can prompt the software to sign a payment redirecting funds to an attacker.

The attack begins when a user tries to raise a transaction fee through Replace-by-Fee (RBF). A malicious server can intercept the broadcast transaction, then cause the wallet history to show a counterfeit transaction sending BTC to an attacker-controlled address. Electrum may sign the substituted transaction as part of the fee increase.

Electrum confirmed receiving two reports of incidents tied to the vulnerability, including one in which a user lost funds. The attackers also generated addresses that shared the final four digits of the expected recipient address.

Electrum fixed the flaw in version 4.8.3 and urged users on older releases to update. It also advised users to check every recipient address and transaction amount before signing. Replace-by-Fee is the fee-bump function at the center of the reported attack.