Electrum Patches Flaw That Let Rogue Servers Hijack Fee-Bumped Bitcoin Transactions

Electrum has released version 4.8.3, patching a vulnerability that allowed malicious servers to trick users into signing bitcoin transactions that sent their funds to attacker-controlled addresses. The fix, published on October 24, 2026, addresses an issue present in all prior versions of the wallet.

The flaw centred on how Electrum handles fee bumps using Replace-By-Fee (RBF). A malicious server could hide a user's original payment and substitute it with a conflicting transaction pointing to an address under the attacker's control. If the user then tried to raise the fee on what they believed was their original payment, the wallet would end up signing the altered transaction instead, sending funds to the attacker.

The developers said they received two reports from users affected by the attack, one of whom lost money after raising a transaction fee. In both cases, the attacker's address matched the last four characters of the address the user had intended to pay, a detail that would make the substitution harder to spot during a casual check.

Version 4.8.3 closes the gap by verifying signatures before accepting an unconfirmed transaction into local history, for inputs spending coins the wallet owns. "This version fixes a critical security issue, so we encourage all users to update," Electrum said.

Electrum noted that clients connected to trusted servers, including self-hosted ones, are not affected by this attack. For users who have not yet updated, the developers recommend manually checking destination addresses and amounts before signing any transaction, including fee increases, and downloading software only from electrum.org while verifying GPG signatures.

Bull Bitcoin says default users unaffected

Bull Bitcoin, whose BULL wallet is built on Electrum's codebase, said its default configuration shields most users from the attack. The wallet connects by default only to two servers run by Bull Bitcoin and one run by Blockstream, meaning users would not be exposed unless they had manually chosen a compromised server by adding its address themselves.

Bull Bitcoin CEO Francis Pouliot said the company is nonetheless moving to adopt the same protection Electrum has now built in. "In any case, we are immediately adding client-side validation with the same approach as the Electrum wallet," he said.

The episode is a reminder for European bitcoin holders who rely on Electrum or Electrum-based wallets that server trust remains a meaningful part of the security model, particularly for users who connect to third-party or self-added servers rather than default or self-hosted infrastructure.