Electrum is a Bitcoin wallet that connects to external servers to retrieve transaction history. Electrum verifies transactions using Simple Payment Verification. When displaying pending transactions, the wallet trusted this function to its primary server.
Attackers intercepted transactions through malicious servers before the information entered the Bitcoin network. By disabling the display of legitimate transactions, criminals could replace them by inserting their own address in place of the recipient’s address. Although the forged transactions contained invalid signatures, vulnerable versions of Electrum did not verify them before displaying the transactions in the wallet history.
The risk occurred when users attempted to increase the transaction fee using the Replace-by-Fee (RBF) feature, which allows replacing an unconfirmed payment with another one featuring a higher fee. By confirming the fee adjustment, users could inadvertently sign a valid transaction benefiting the attacker.
Developers confirmed two cases of cryptocurrency theft. On October 11, a wallet owner using the pseudonym dannydeezy reported that a transaction displayed in the Electrum history did not match the originally sent payment. Another anonymous user, Raju-K12, notified developers on October 18 that they lost funds while attempting to increase the transaction fee. In their case, the fraudulent transaction had a zero fee, which, according to the Electrum team, was done to prompt the victim to initiate the fee increase themselves.
The vulnerability affected all Electrum versions prior to 4.8.3. The developers did not specify the amount of stolen funds, the number of servers involved in the attack, or the number of victims. The wallet team released a fix, adding it to version 4.8.3 on October 23. The downloadable binaries became available on October 24. The developers implemented signature verification for unconfirmed transactions and clarified that the update does not turn Electrum into a full Bitcoin node. This means that incoming unconfirmed transactions remain outside the new signature verification checks, while confirmed payments continue to undergo the previous verification procedures.
Owners of earlier wallet versions are advised to download the update from the official Electrum website. Those unable to update quickly should verify the full recipient addresses and amounts before signing transactions, including fee replacements. Users connecting only to trusted servers, including their own, are not vulnerable to this attack.
Recently, Symantec Threat Hunters discovered a new version of the info-stealer Aoki (Aokigahara)—a program that steals AI assistant session files, cookies, and cryptocurrency wallet data. Hackers use the stolen API keys to gain access to associated repositories and cloud services.