Electrum issued version 4.8.3 of its Bitcoin wallet software on October 24, 2026, addressing a critical security vulnerability that attackers have already exploited. The flaw affects all releases prior to 4.8.3 and centers on how the wallet handles unconfirmed transactions supplied by servers.

How the Attack Operates

Electrum wallets rely on external servers to fetch transaction history and broadcast payments. A malicious server can suppress a user’s original unconfirmed payment and insert a conflicting transaction that directs funds to an attacker-controlled address. Older versions of the software displayed these substituted transactions as unconfirmed without first verifying the signatures on inputs that spend the user’s own coins.

When a user later attempts to raise the fee on what appears to be their pending payment using the replace-by-fee mechanism, the wallet signs the altered transaction. The result is that bitcoin leaves the user’s control and arrives at the attacker’s destination. In the reported cases, the attacker-generated addresses shared the final four characters of the address the user originally intended to pay, increasing the chance that a hurried visual check would miss the substitution.

Developers confirmed receiving two independent incident reports linked to the vulnerability. One of those users lost funds after performing a manual fee increase. The project stated that some servers are already carrying out the attack in the wild.

Details of the Patch

Version 4.8.3 introduces a verification step that examines signatures on relevant transaction inputs before an unconfirmed transaction is accepted into the wallet’s local history. This change closes the window that previously allowed a malicious server to present an invalid substitute for user approval during a fee bump.

Clients that remain connected exclusively to trusted servers, including those operated by the Electrum project itself, are not exposed to the attack vector. Users who connect to arbitrary or third-party servers face the risk until they upgrade.

Guidance for Users and Related Projects

Electrum advised anyone still running an older version to upgrade immediately. Until the update is installed, users should carefully verify every destination address and amount before signing any transaction, including fee increases. The project also reminded the community to obtain software solely from electrum.org and to confirm the accompanying GPG signatures.

A separate note accompanying the release addressed a possible Windows Defender alert concerning the file ZXing.dll. Developers described the alert as a false positive unrelated to the security fix.

Bull Bitcoin’s BULL wallet, which defaults to a small set of known servers operated by Bull Bitcoin and Blockstream, was not affected unless users had manually added a compromised server. Chief executive Francis Pouliot stated that the company is adding matching client-side signature validation.

The episode underscores the importance of signature validation on unconfirmed data and the risks that arise when lightweight wallets place trust in external servers for transaction history. Users of Electrum are expected to move to 4.8.3 without delay to eliminate the described exposure.