Electrum Fixes Security Flaw Allowing Bitcoin Theft Without Private Keys

Electrum has fixed a security flaw that let attackers redirect Bitcoin payments when users increased transaction fees, without stealing private keys. The developers announced the vulnerability on Oct. 24 and confirmed that malicious servers had exploited the flaw. The developers confirmed that at least one user unknowingly approved a fraudulent transaction and lost Bitcoin. The high-severity vulnerability affects versions before 4.8.3.

The disclosure came after complaints received on Oct. 11 and Oct. 18. The first complainant saw an unfamiliar transaction in the wallet after broadcasting a payment. The second complainant reported losing funds while trying to accelerate a pending transfer. Attackers in both incidents created Bitcoin addresses whose last four characters matched the intended recipients' addresses. Those similarities could deceive users who checked only part of an address.

The vulnerability exploits Electrum's dependence on external servers for information about unconfirmed transactions. A malicious server can stop a user's broadcast payment from reaching the network and provide a conflicting transaction directing funds to an attacker-controlled address. The substituted transaction initially has invalid signatures and therefore cannot be processed as a valid payment. However, vulnerable Electrum clients displayed the substituted transaction in the unconfirmed transaction history without first checking the signatures. The genuine payment consequently disappears from that view, while the fraudulent payment appears to await confirmation.

Attackers can then misuse Bitcoin's Replace-by-Fee feature, which lets users raise fees to encourage miners to confirm delayed transactions. Electrum creates new signatures approving the substituted payment details if a user manually raises the fraudulent transaction's fee. The new approval validates the attacker-directed payment and enables theft without exposing the user's private keys. Attackers reportedly assigned a zero fee to the fraudulent transaction in the Oct. 18 incident, potentially prompting the victim to increase the fee. The attack demonstrates the risk of accepting transaction details from an untrusted server without sufficient checks.

The latest Electrum release checks signatures on wallet-owned inputs before adding unconfirmed transactions to the local history. Those checks prevent the reported substitution method from progressing to a fee adjustment. The developers tagged version 4.8.3 on Oct. 23. The developers distributed the update on Oct. 24 together with the public security disclosure.

The developers advised users to obtain the patch through Electrum's official website. The developers also urged users to check full recipient addresses and payment amounts each time users sign transactions. The advisory says clients using only trusted servers, including privately operated servers, are not vulnerable to this attack. The patch does not check signatures for every incoming transaction.

Electrum did not reveal the amount stolen. Electrum's maintainers confirmed that some servers were actively conducting the attack. The number of compromised wallets and the total funds stolen remain unresolved.