✓ Verified by 2+ outlets BTC
Electrum patches a flaw that let rogue servers steal bitcoin when users bumped a 'stuck' payment's fee
Summary
Electrum, one of Bitcoin's oldest software wallets, has patched a high-severity flaw that let malicious servers trick users into paying attackers, and at least one user lost funds, CoinDesk and Decrypt reported on Oct. 26.
Before the fix, Electrum trusted its servers to report pending transactions without checking their signatures, so a rogue server could hide a real payment and show a fake, zero-fee one sending the coins to an attacker's address, the outlets said.
When a user then used Replace-by-Fee to speed up the payment that looked stuck, Electrum signed a valid replacement that actually paid the attacker; Decrypt noted attackers could make the fake address end in the same four characters as the real one.
Electrum 4.8.3, released Oct. 24, now verifies signatures on unconfirmed transactions that spend the user's own coins, but older versions stay exposed on malicious servers, and Decrypt reports incoming transactions from outside senders are still not verified.
Key facts
- Electrum disclosed the vulnerability on Saturday, saying some servers were already exploiting it.
- A first report on Oct. 11 involved a 2-of-3 multisig wallet using two Trezor devices; that user did not report losing funds.
- A second user reported on Oct. 18 losing funds after fee-bumping a substituted transaction; the amount stolen has not been disclosed.
- The fix was tagged in Electrum's repository on Oct. 23 and binaries were published the next day.
- Users connected only to servers they trust, including their own, were not exposed to the attack.
- A 2018 campaign of rogue Electrum servers pushing fake update notices had drained an estimated $25 million from users by 2020.
Related stories
- Bitcoin drops below $72,000 as spot ETFs bleed $1.44 billion in five days and BlackRock's IBIT loses $2 billion in nine
- Bitcoin treasury firm Nakamoto owes Kraken $165 million, more than its market value, as Q3 operating revenue turns negative
- Binance sets aside $6.34 billion to cover record hack as TRM and Chainalysis tie it to North Korea's TraderTraitor