ROGUE ELECTRUM SERVERS SWAPPED REAL PAYMENTS FOR UNSIGNED FAKES — ONE USER BUMPED THE FEE AND PAID THE THIEF — 4.8.3 CHECKS ONLY THE WALLET’S OWN INPUTS

On October 24, 2026, the Electrum wallet project published a security advisory rated high. A malicious server could drop a payment the user had just broadcast and show the wallet a different transaction spending the same coins to an attacker. Electrum did not check that second transaction's signatures, so the fake sat in the wallet's history as an ordinary pending payment. The advisory says "some servers are performing this attack in the wild."

The trap was the fee bump. The fake carried a fee of zero, so it would never confirm. A user who saw a stuck payment and raised the fee was asking the wallet to sign the fake again, this time for real, with a valid signature and a higher fee. One user did that and lost money, reported privately on October 18. The attacker's address matched the last four characters of the real one. An earlier report on October 11 came from a user who had checked the outputs on two Trezors before signing. The hardware wallets showed the right payment. The wallet screen after them did not.

The cause is design, and the advisory says so. Electrum is a light client. It trusts its server for unconfirmed transactions, and the project calls that intended. Version 4.8.3, tagged October 23 and released October 24, now checks signatures on inputs that spend the wallet's own coins, for unconfirmed transactions only. Inputs from anyone else still go unchecked, because checking them would take a full consensus engine.

What you can check, you do not have to trust. Users connected to a server they run themselves were not exposed, per the advisory. Everyone else was taking a stranger's word for what was in the mempool. The advisory gives no loss amount and no count of bad servers. The release notes credit four people for security reports and publish one advisory. Upgrade, and read the address and amount on every fee bump before you sign. At the time of this writing, bitcoin was $80,286.