Bitcoin wallet fixes critical flaw that redirected funds to attackers

Bitcoin wallet Electrum patched a high‑severity vulnerability over the weekend, fixing a flaw that let rogue servers manipulate unconfirmed transactions and redirect funds to attacker‑controlled addresses. The issue affected all versions prior to 4.8.3, which was released on October 24.

The attack works by suppressing the real transaction and injecting a fake one that appears stuck; when the user fee‑bumps the transaction, the signed broadcast actually sends funds to the attacker. Two users reported losses, with one confirmed loss on October 18.

Version 4.8.3 now verifies cryptographic signatures on wallet‑owned inputs before adding any unconfirmed transaction to local history, preventing fake injections. Incoming transactions from external senders still lack this check and will require further work. Users running their own Electrum server are unaffected, and anyone unable to update should manually verify output addresses before signing.

Summary rewritten by AI from the original article by Decrypt.