Electrum Wallet Update 4.8.3 Fixes Flaw Used to Steal Bitcoin Through Fee Bumps

If you send bitcoin with Electrum, check your version number before your next payment. The Electrum wallet update to version 4.8.3, released on October 24, fixes a critical flaw that attackers have already used to steal bitcoin, and the developers are asking every user to upgrade.

The bug sat in how the desktop wallet handled pending transactions. A malicious server could slip a fake payment into a user's history, and the theft happened the moment the victim tried to speed that payment up with a higher fee. Here is who is exposed, what the patch changes, and what to do now.

How a fee bump turned into a theft

Electrum is a light wallet. It does not download the full Bitcoin blockchain, so it leans on outside servers to fetch transaction history, estimate fees and broadcast payments. Confirmed transactions were always checked. Unconfirmed ones were not, and that gap is the whole story.

According to the security advisory (GHSA-6jp4-8v48-cc5v), as reported by Bitcoin.com News and crypto.news, a compromised server could work in four moves:

1. Catch a legitimate outgoing payment and quietly refuse to broadcast it.
2. Send the wallet a substitute transaction paying an address the attacker controls.
3. Use an address that ends in the same four characters as the real recipient, so a quick glance would not catch the swap.
4. Wait for the user to raise the fee.

The substitute carried invalid signatures, so on its own it could never move money. Older Electrum versions displayed it as a normal pending payment anyway. When the user used Replace by Fee (RBF) to bump it, the wallet produced a fresh, valid, signed transaction that now paid the attacker. In one reported case the fake transaction carried a zero fee, which developers believe was bait to prompt exactly that fee bump.

Two private reports, and no loss total yet

Developers received two private reports. On October 11, a user known as dannydeezy flagged a history entry that did not match the payment they had made. crypto.news reports the wallet was a 2 of 3 multisig built on two Trezor devices, and the fake entry sent nearly all of its bitcoin to a lookalike address. That user's original transaction was never broadcast.

On October 18, a second user, Raju-K12, reported losing funds after approving a fee increase. Neither outlet says how much bitcoin was taken, and Electrum has not said how many servers were involved.

The Trezor case is a useful warning. A hardware wallet signs what the software asks it to sign, which is why reading the full address on the device screen matters so much.

Who needs the Electrum wallet update

You are exposed if all of these apply to you:

• You run any Electrum version older than 4.8.3.
• Your wallet connects to public servers, which is the normal setup.
• You send bitcoin, and especially if you ever raise fees on stuck payments.

According to the advisory, people who connect only to servers they trust, such as their own self hosted Electrum server, are not exposed to this specific attack. The trick targets outgoing payments, so the risk sits in what you sign.

What version 4.8.3 changes

The fix, in commit 90fe308, makes Electrum verify signatures on unconfirmed transactions that spend coins from your wallet. A transaction with bad signatures is now rejected before it reaches your local history, so there is nothing fake left for you to bump.

crypto.news points out two limits. Incoming unconfirmed transactions are not covered by the new check, and the developers stress that the update does not turn Electrum into a full node. You still rely on servers for some data. Electrum's own post on X was blunt: "This release fixes a critical security issue, so we urge all users to upgrade."

Seven steps before you send another payment

1. Check your version. Look at the version number in the app's About screen. Anything below 4.8.3 needs replacing.
2. Download only from electrum.org. Earlier attacks on Electrum users relied on fake update prompts, so ignore any upgrade message that appears inside the app and type the address yourself.
3. Verify the download. The official site publishes signatures and instructions for checking them. It takes a few minutes and confirms the file was not altered.
4. Expect one false alarm on Windows. Developers say Windows Defender may flag a file called ZXing.dll, and that the warning can be ignored.
5. Review your recent history. Look for pending payments to addresses you do not recognize, and compare the full address, not just the first or last few characters.
6. Hold off on fee bumps until you upgrade. If you must send now, confirm the complete address and amount on your hardware wallet screen before approving anything, including an RBF replacement.
7. Consider your own server if you move meaningful sums, since the advisory says that setup avoids this attack.

Not the first time public servers were the weak spot

Electrum's reliance on public servers has been turned against its users before. In December 2018, malicious servers pushed fake update messages, and losses reportedly approached $1 million. This attack was quieter. It worked inside a genuine copy of the wallet and leaned on a lookalike address trick, the same basic idea behind the address poisoning that followed Arthur Hayes's Maelstrom sale.

Wallet users have had a rough month, from the Ngrave hack built on fake Liquid alerts to the Ledger Cryptobilis wallet drain. With bitcoin trading around $80,000 after a week of heavy ETF outflows, busy markets and stuck payments are likely to return. The habit that would have stopped this theft costs nothing: read the whole address before you sign. More wallet security coverage is on our crypto page.