---
title: "Electrum Patches Replace-By-Fee Vulnerability After Rogue Servers Steal Bitcoin"
description: "A client flaw allowed malicious servers to spoof unconfirmed transaction history and trick users into signing fee bumps that redirected funds."
url: https://basisdesk.news/news/electrum-patches-rbf-vulnerability-malicious-servers
published: 2026-10-26T05:32:05.825Z
modified: 2026-10-26T05:32:05.825Z
section: Security & Hacks
author: Basis Desk Newsroom (AI-generated, source-verified)
sentiment: bearish
tickers: [BTC]
tags: [electrum, bitcoin-wallet, replace-by-fee, exploit, patch]
license: Quote with attribution to Basis Desk (basisdesk.news). Not financial advice.
---

# Electrum Patches Replace-By-Fee Vulnerability After Rogue Servers Steal Bitcoin

A client flaw allowed malicious servers to spoof unconfirmed transaction history and trick users into signing fee bumps that redirected funds.

## At a glance

- **What happened:** Electrum issued version 4.8.3 to resolve a vulnerability that allowed malicious servers to trick users into redirecting transactions via RBF fee bumps [1].
- **Why it matters:** Active exploitation in the wild caused user financial loss by spoofing unconfirmed wallet transactions [1].
- **Who is affected:** Electrum wallet users connected to public, untrusted backend servers [1].
- **Takes effect:** 2026-10-24
- **What's next:** Users must upgrade to version 4.8.3 or carefully review destination addresses before signing fee bumps [1].
- **Primary source:** [Malicious server can replace a just-broadcast tx and try to trick user into RBF-ing it](https://github.com/spesmilo/electrum/security/advisories/GHSA-6jp4-8v48-cc5v) — github.com

## Key points

- Electrum released version 4.8.3 after rogue servers exploited mempool history handling to redirect bitcoin transactions [1].
- Adversaries served spoofed, zero-fee transactions with matching tail characters, tricking victims who initiated RBF fee bumps [1].
- The fix verifies signatures on wallet-owned inputs before adding mempool transactions to client history [1].

## Editorial remark

- **Context:** Electrum relies on remote servers for mempool status by design to maintain a lightweight footprint, historically relying on SPV proofs exclusively for mined blocks [1].
- **Impact:** Users connected to public, untrusted Electrum servers risked fund theft when attempting to fee-bump stalled unconfirmed transactions [1].
- **Watch:** Adoption rates for Electrum version 4.8.3 and reports of any alternative spoofing vectors on non-wallet inputs [1].

Bitcoin wallet software Electrum released version 4.8.3 following reports that rogue servers exploited mempool handling to trick users into redirecting transactions, according to a GitHub security advisory published on Oct. 24 [1]. The update addresses an architectural blind spot where light clients inherently trust connected servers for unconfirmed transaction data [1]. At the time of writing, $BTC traded around $80,098.

The vulnerability stems from how the Electrum client handles mempool updates [1]. When an end user broadcast an initial transaction, an adversary operating an untrusted server could withhold it from the peer-to-peer network and feed the wallet an invalid replacement transaction containing the attacker's payout address [1]. Because Electrum operates as a lightweight client without a local script interpreter, it displayed the server's fabricated unconfirmed transaction in the wallet interface without verifying signatures [1]. If the user subsequently initiated a manual replace-by-fee (RBF) fee bump, the wallet generated valid signatures for the adversary's outputs, routing the balance directly to the attacker [1].

## Exploitation in the Wild and Deployment Fix

Electrum received two separate reports from affected users indicating the vector was being exploited in the wild [1]. The initial disclosure arrived on Oct. 11, though developers only identified the RBF attack vector after a second user reported financial losses on Oct. 18 [1]. Both users noted that the malicious servers generated vanity addresses matching the final four characters of the legitimate destination, while one server created the spoofed transaction with a zero fee to incentivize a manual fee bump [1].

Electrum tagged the patch on Oct. 23 and published binaries the following day [1]. Version 4.8.3 enforces signature validation for any mempool transactions that spend outputs owned by the local wallet [1]. Maintainers cautioned that incoming transactions remain unverified prior to block confirmation, as full validation would require recursively evaluating unconfirmed parent transactions without a full consensus engine [1]. Users running their own nodes or connecting exclusively to trusted backend servers were not impacted by the issue [1].

## Sources

1. [Malicious server can replace a just-broadcast tx and try to trick user into RBF-ing it](https://github.com/spesmilo/electrum/security/advisories/GHSA-6jp4-8v48-cc5v) — github.com, 2026-10-26

---
Basis Desk Newsroom · AI-generated, source-verified · https://basisdesk.news/about/how-we-use-ai