ChainCatcher report: On October 24, the Bitcoin lightweight wallet Electrum disclosed a malicious server attack targeting transaction fee bumping, which was patched in version 4.8.3, corresponding to the GitHub security advisory GHSA-6jp4-8v48-cc5v. When users routinely bump transaction fees, they may inadvertently sign over their funds to an attacker. Developers noted that the issue arose after users reported losing funds after signing fee bumps. Two reports yielded different outcomes: one user broadcast a payment only to discover that the transaction in their wallet history had been replaced, claiming the original payment never entered the Bitcoin peer-to-peer network and was withheld by the server; another user, Raju-K12, bumped the replaced transaction and lost funds. In the attack, the malicious server withholds the new transaction broadcast by the client and inserts a conflicting transaction into the history, replacing the original output with the attacker’s address. At the time, the replacement transaction had an invalid signature, but lightweight clients do not verify these signatures before displaying unconfirmed transactions; after users manually bump fees via RBF and sign the transaction, the attacker’s收款 becomes valid. Both users reported that the attacker’s address ended with the same four digits as the legitimate recipient address. The advisory did not disclose the stolen amount, transaction IDs, or the attacker’s address. The patch corresponds to commit 90fe308, which verifies signatures of inputs owned by the wallet before writing mempool transactions to local history, but does not validate inputs from addresses outside the wallet or perform full consensus validation. The advisory recommends that users who have not upgraded verify output addresses and amounts with each signature; clients connected to self-hosted or trusted servers are not affected by this attack. On the timeline: the issue was first privately disclosed on October 11, fee-bumping loss reports were received on October 18, the patched version was tagged on October 23, and binaries along with public disclosure occurred on October 24.
Bitcoin Wallet Electrum Patches Fee Theft Vulnerability in Version 4.8.3
ChaincatcherShare
Summary
Bitcoin news broke on October 24 after the Electrum wallet patched a fee theft vulnerability in version 4.8.3. Attackers exploited transaction volume to siphon funds by replacing legitimate transactions with invalid signatures. Two users reported losses, with one noting the attacker’s address matched the last four digits of the intended recipient’s address. The fix now verifies signatures before updating local transaction history. Electrum urged users to carefully verify addresses and amounts before signing transactions. The issue was privately reported on October 11, with the first loss occurring on October 18 and the patch released on October 23.
Source:Show original
Disclaimer: The information on this page may have been obtained from third parties and does not necessarily reflect the views or opinions of KuCoin. This content is provided for general informational purposes only, without any representation or warranty of any kind, nor shall it be construed as financial or investment advice. KuCoin shall not be liable for any errors or omissions, or for any outcomes resulting from the use of this information.
Investments in digital assets can be risky. Please carefully evaluate the risks of a product and your risk tolerance based on your own financial circumstances. For more information, please refer to our Terms of Use and Risk Disclosure.