Electrum Patch Fixes Flaw That Let Servers Steal Bitcoin

A security flaw in the Electrum Bitcoin wallet allowed malicious servers to substitute fake pending transactions when users tried to speed up payments using Replace-by-Fee. The attack exploited how Electrum handles unconfirmed payments by relying on outside servers to retrieve transaction histories. An attacker controlling a server could intercept a payment and replace it in the wallet's history with a fake transaction spending coins to an attacker-controlled address. Electrum failed to detect the invalid signatures on these fraudulent transactions. When users selected the Replace-by-Fee option, the software could sign a valid replacement sending the coins to the attacker. In one reported case, the malicious transaction carried no fee, making it appear stuck.

Attackers generated receiving addresses whose last four characters matched the legitimate destination to make the substitution harder to spot. The first report of the attack was submitted on October 11 involving a two-of-three multisignature wallet using two Trezor hardware devices. A user in the first report checked the legitimate payment on both devices but later noticed a different outgoing transaction in the wallet's history without reporting a loss of funds. A second user reported on October 18 that they had raised the fee on a substituted transaction and lost money. Developers have not disclosed the amount stolen or identified the malicious servers.

Electrum released version 4.8.3 on October 24 to verify signatures on relevant unconfirmed transactions. The fix verifies signatures on wallet-owned inputs before displaying unconfirmed transactions, but incoming transactions from external senders remain unverified. Earlier versions of Electrum remain vulnerable when connected to malicious servers. Users should upgrade Electrum and carefully verify payment addresses and amounts before signing transactions.