Electrum patches vulnerability that allowed rogue servers to divert payments
CIE News ·
Based on reporting by CoinDesk; not yet independently confirmed.
Electrum fixed a security flaw exploited by rogue servers to divert user funds via Replace-by-Fee requests, with developers confirming one user suffered a loss, according to CoinDesk.
Electrum released version 4.8.3 on October 24, 2026, to fix a security flaw that rogue servers used to divert Bitcoin (BTC) transactions, CoinDesk reported. The vulnerability allowed untrusted external servers to feed fake pending transactions with invalid signatures into a wallet's history. When a user attempted to accelerate the unconfirmed payment using Bitcoin's Replace-by-Fee feature, the wallet would sign a legitimate replacement that routed the funds to the attacker.
Developers disclosed the issue after receiving two incident reports in October 2026, according to CoinDesk. An initial report on October 11 involved an unconfirmed payment substitution on a multisignature wallet that resulted in no stolen funds, but a second report on October 18 confirmed that a user lost money after boosting the fee on a substituted transaction. Attackers also used recipient addresses matching the last four characters of the intended destination to conceal the swap.
Electrum added signature verification for unconfirmed transactions spending from a user's wallet in version 4.8.3, according to CoinDesk. Developers stated that users operating their own servers or connecting exclusively to trusted nodes were not affected by the exploit.
Key facts
- Patched in Electrum 4.8.3
- Replace-by-Fee exploited
- One theft confirmed by team
- Patched on Oct. 24, 2026