Other cyber events · Developing
Electrum servers can fake a payment you just sent. The 4.8.3 update fixes it
A dishonest Electrum server can swap the payment you just sent for a fake one that pays an attacker. Updating Electrum to version 4.8.3 fixes it.
What happened
Electrum is a free app for holding and spending Bitcoin. On October 24 the maker published a high-severity warning.
The app shows your payments through a helper computer called a server. Your app trusts that server for payments that are not yet confirmed.
A dishonest server can hide the payment you just sent. It then shows a fake payment in its place.
The fake payment pays an attacker. Its address matches the end of your real address, so a quick look misses the change.
The fake payment carries broken check values. The old app did not check them, so it showed the fake as real.
If you then raise the fee to speed up the payment, the app signs the attacker's address. Your money goes to them.
Electrum says some servers ran this trick for real. Two users reported it, and one lost money.
Electrum released version 4.8.3 with a fix. The update checks payment details before the app shows them.
Sources: GHSA-6jp4-8v48-cc5v: Malicious server can replace a just-broadcast tx and try to trick user into RBF-ing it; Release 4.8.3 (October 23, 2026) (security update)
Who’s affected
This report concerns people who use the Electrum app for Bitcoin.
Only apps older than 4.8.3 are at risk. The risk needs a connection to a server run by someone else.
People who connect their app only to their own server are not affected.
The trick targets what the app shows on your screen. The Bitcoin network itself was not attacked.
Money is lost only when a person confirms the fake payment while raising a fee.
What to do
- Open Electrum. Open the Help menu, then About. It shows your version number.
- If your version is older than 4.8.3, download the update from electrum.org.
- Do not use a search result or an email link for the download. Use the official site only.
- Until you update, read the full payment address before you confirm any payment.
- Before you raise the fee on a payment that has not arrived, read the address again.
- If the address has changed, do not raise the fee. Start the payment again instead.
- If you already paid the attacker, save the payment record. Then report the loss to Electrum on GitHub.
- Check the Electrum site for updates from time to time. The maker asks users to upgrade regularly.
- If you run your own Electrum server, connect to it only. This trick cannot reach you there.
Sources: GHSA-6jp4-8v48-cc5v: Malicious server can replace a just-broadcast tx and try to trick user into RBF-ing it; Release 4.8.3 (October 23, 2026) (security update)
What we do not know yet
Electrum does not know how many servers run the trick. It says some servers do.
Two users reported the attack. The full number of people who lost money is unknown.
No one has published the names of the people behind the dishonest servers.
Incoming payments get less checking. When you receive Bitcoin, stay alert.
Electrum has not listed the dishonest servers by name or address.
Guides for your next step
Sources
- GHSA-6jp4-8v48-cc5v: Malicious server can replace a just-broadcast tx and try to trick user into RBF-ing it
Electrum (spesmilo/electrum)
- Release 4.8.3 (October 23, 2026) (security update)
Electrum (spesmilo/electrum)