Electrum, one of the longest-running Bitcoin wallets and still widely used across Europe, pushed out version 4.8.3 on October 24, 2026, to close a high-severity security hole that could allow a malicious server to reroute a user's funds through a transaction-replacement trick.
The project disclosed the update on its official account, writing: "New release: Electrum 4.8.3. This release fixes a critical security issue, so we urge all users to upgrade. A description of the vulnerability will be published later today." The team added a note that Windows Defender might flag a file called ZXing.dll during installation, calling it "a false positive."
The vulnerability, catalogued as GHSA-6jp4-8v48-cc5v, affects all versions 4.8.2 and earlier. According to the release notes, it is a "(high severity) A malicious server can replace a recently broadcast transaction and attempt to trick the user into accelerating it via RBF" — a reference to Replace-By-Fee, the Bitcoin feature that allows an unconfirmed transaction to be resubmitted with a higher fee.
How the attack works
Two conditions must be met for the attack to succeed: the victim's wallet must be connected to a malicious Electrum server, and the victim must then choose to accelerate the pending transaction via RBF. Users who run their own Electrum server are not exposed to this attack vector, since the malicious-server dependency is removed.
This is Electrum's second security-focused release in little over two months. The previous patch, version 4.8.1, landed on August 12. The project has a long history of being targeted through its server infrastructure, and this latest flaw follows the same pattern: a hostile server attempting to manipulate what the client displays and signs.
A Windows Defender false alarm, and a parallel incident
Alongside the fix, the update introduced "barcode scanning with QtMultimedia and QR code recognition from zxing-cpp" under pull request #10955 on GitHub, which brought the ZXing.dll file into Windows installations. The file, dated 11/11/2000 and sitting in the _internal directory, triggered warnings from some antivirus software. A scan using Windows Defender version 1.461.181.0, dated 24/10/2026, returned no threat found, consistent with the project's description of a false positive.
The same day Electrum issued its fix, a similar vulnerability was reported in Cake Wallet, another widely used open-source Bitcoin and Monero wallet, suggesting the underlying weakness in handling RBF-based transaction replacement is not confined to a single piece of software.
For European users, many of whom rely on Electrum as a lightweight, self-custodial option precisely because it avoids the overhead of running a full node, the advisory is a reminder that server trust remains a structural weak point of SPV-style wallets. Upgrading to 4.8.3 closes the immediate hole; running a personal Electrum server removes the dependency altogether.
