Electrum vulnerability let rogue servers hijack fee-bump signatures
Security & Exploits ·
A flaw in the Electrum Bitcoin wallet allowed compromised servers to swap in fraudulent transactions that users then unknowingly authorized while trying to pay higher network fees, with at least one confirmed loss of funds before a fix shipped.
Electrum disclosed the issue over the weekend, noting it had received two separate reports in October tied to the exploit, according to coindesk.com. Because Electrum depends on external servers rather than running a full node to track pending payments, it previously accepted those servers' reports of unconfirmed transactions without checking their signatures. A malicious server could intercept a payment before it reached the network, substitute it with a fake transaction carrying invalid signatures to an attacker's address, and have Electrum display it as merely pending.
The trap activated when users invoked Replace-by-Fee, a standard Bitcoin feature for resending a stuck transaction with a higher fee. If a victim tried to speed up what looked like their own delayed payment, Electrum would sign a valid, higher-fee version of the attacker's substituted transaction, completing the theft. In one case the fake transaction carried no fee at all, so it appeared stalled, and attackers reportedly generated lookalike receiving addresses matching the last four characters of the real destination to evade casual inspection, a detail also noted by defiprime.com.
The first report, filed Oct. 11, involved a two-of-three multisignature setup using two Trezor hardware devices; the user had verified the legitimate payment on both devices but later spotted an unfamiliar outgoing transaction, though no funds were lost in that instance. A second user, reporting on Oct. 18, raised the fee on a substituted transaction and did lose money. Electrum has not disclosed the amount taken or named the malicious servers involved.
Electrum pushed version 4.8.3 on Oct. 24, adding signature verification for unconfirmed transactions spending a wallet's own coins, closing the specific gap exploited in these cases. Earlier versions remain exposed when connected to a malicious server, and developers are urging users to upgrade and manually check addresses and amounts before signing. Wallets limited to trusted servers, including self-run nodes, were not affected.
Unresolved questions include the scale of losses beyond the two reported incidents, the identity or number of malicious servers still operating, and whether additional thefts will surface as more users move to patched versions.