An Electrum security flaw let malicious servers deceive users into authorizing bitcoin payments to attackers when users tried to increase transaction fees. Developers confirmed at least one case involving stolen funds. Electrum disclosed the vulnerability on Saturday and said some servers were already exploiting the flaw. Developers received two reports in October, including a report from a user who lost funds after approving an apparent routine fee increase.
Electrum retrieves transaction histories and broadcasts payments through external servers, unlike a full Bitcoin node. Before the patch, Electrum accepted server information about unconfirmed transactions without validating transaction signatures. An attacker controlling a server could intercept a payment before the payment reached the Bitcoin network. The attacker could then substitute a fake transaction in the wallet history, directing the user's coins to an attacker-controlled address. Electrum did not detect the invalid signatures and showed the fake payment as pending.
Bitcoin's Replace-by-Fee feature lets users replace unconfirmed transactions with transactions that pay higher fees. When a user chose Replace-by-Fee, Electrum could sign a valid replacement for the fraudulent transaction and send the coins to the attacker. One reported malicious transaction had a zero fee, creating the appearance of a stalled payment. Attackers also created destination addresses with the same final four characters as the intended addresses, making a quick visual check less reliable.
The first report arrived on October 11 and concerned a two-of-three multisignature wallet with two Trezor hardware devices. The user verified the intended payment on both devices but subsequently found a different outgoing transaction in the wallet history. The first user did not report any loss. A second user reported on October 18 that increasing the fee on a substituted transaction had resulted in stolen funds. Developers have not revealed the stolen amount or named the malicious servers.
Electrum released version 4.8.3 on October 24 in response to the vulnerability. The update introduced signature validation for unconfirmed transactions that spend coins belonging to the user's wallet. The fix arrived six days after the first reported theft. However, older versions remain vulnerable to the reported attack through malicious servers. Developers advise users to upgrade and verify destination addresses and payment amounts before authorizing payments. Users who connected exclusively to trusted servers, including servers the users operated, were not exposed to this attack.