News · Security & Hacks
A client flaw allowed malicious servers to spoof unconfirmed transaction history and trick users into signing fee bumps that redirected funds.
Key point 1 of 3
01
Electrum released version 4.8.3 after rogue servers exploited mempool history handling to redirect bitcoin transactions .
Key point 2 of 3
02
Adversaries served spoofed, zero-fee transactions with matching tail characters, tricking victims who initiated RBF fee bumps .
Key point 3 of 3
03
The fix verifies signatures on wallet-owned inputs before adding mempool transactions to client history .
Context
Electrum relies on remote servers for mempool status by design to maintain a lightweight footprint, historically relying on SPV proofs exclusively for mined blocks .
Why it matters
Users connected to public, untrusted Electrum servers risked fund theft when attempting to fee-bump stalled unconfirmed transactions .
What to watch
Adoption rates for Electrum version 4.8.3 and reports of any alternative spoofing vectors on non-wallet inputs .
Sources
Built from 1 primary source, machine-checked before publication.
Keep reading
Read the full story
AI-generated, source-verified. Sources, citations and live prices on the article page.