Electrum Wallet Flaw Allows Bitcoin Theft During Transactions

A vulnerability in the Electrum wallet allowed malicious servers to divert user funds. The attack occurred when people attempted to speed up pending payments on the Bitcoin network.

The issue exploited how the software processes unconfirmed transactions. Servers controlled by attackers intercepted the operation and replaced the data with a fraudulent transaction. The system failed to verify the digital signatures of information received from external sources.

The trap was triggered when the user utilized the function to replace transactions with higher fees. While trying to accelerate the process, the wallet owner signed a valid version of the fraudulent transaction. This sent the assets directly to an address controlled by the criminals.

Attackers created destination addresses with ending characters identical to the originals to avoid suspicion. Developers confirmed at least one case of financial loss following reports received in October. The flaw affected the software's trust in data from third-party servers.

A security update was released on October 24 to fix the loophole. Version 4.8.3 now requires mandatory signature verification for pending transactions. Previous versions of the program remain exposed to the risk of exploitation by malicious servers.

Security flaws in custody infrastructures increase operational risk and may raise asset volatility due to a loss of confidence in network integrity.