Overview
- Electrum released version 4.8.3 on Oct. 24 to fix a high‑severity flaw that let malicious public servers substitute fake unconfirmed outgoing transactions.
- Attackers hid a real outgoing payment, showed a counterfeit pending transaction that sent funds to an attacker address, and then waited for the user to use Replace‑by‑Fee so the wallet would sign a valid payment to the attacker.
- Developers received two private reports in October, including a Oct. 18 case where a user lost bitcoin after approving a fee bump on a substituted transaction, but the total number of malicious servers and amount stolen remain undisclosed.
- The 4.8.3 patch (commit 90fe308) makes Electrum verify cryptographic signatures on unconfirmed transactions that spend the wallet’s own inputs so fake outgoing payments with invalid signatures are rejected before they appear in history.
- Users should download the signed release from electrum.org, verify its signature, and check full recipient addresses and amounts before signing any transaction because older Electrum versions remain vulnerable when connected to malicious public servers.