electrum 4.8.3 just patched a high-severity light-wallet trap (advisory oct 24). a malicious electrum server can swap the tx you just broadcast for a fake conflicting one with the attacker's output — often grinding the last few address chars so it looks familiar — and if you hit accelerate / rbf, you sign the theft. anything below 4.8.3 is in the blast radius. some servers are already doing this in the wild. no cve listed. amounts lost weren't published. the fix checks signatures on your own inputs before a mempool tx lands in history. if you can't update yet: before any bump, re-check addresses and amounts yourself. running your own server also sidesteps the trust problem. light clients always leaned on the server for mempool view — this is that trade-off biting, not the chain failing... just saying!