Electrum 4.8.4 Drops Incoming Lightning Onion Messages After a Flaw

Electrum 4.8.4, released Nov. 6, now discards incoming Lightning Network onion messages after malformed messages from any source were found able to disconnect the Bitcoin (BTC) wallet from a channel peer. The wallet will continue dropping those messages until Electrum implements a use for them.

The update also fixes a recovery bug affecting some seed phrases created before Electrum 2.0. The problem involved phrases that decode to an odd-length hexadecimal string and had been present since version 4.6.1.

Electrum’s previous version, 4.8.3, is dated Oct. 23, while its binaries were released Oct. 24. That version fixed a separate high-severity flaw involving a malicious server that could hide a transaction a user had just broadcast and show the wallet a conflicting, invalid transaction containing the attacker’s address. If the user then raised the fee on the displayed transaction through replace-by-fee (RBF), the wallet could sign it and pay the attacker.