Electrum disclosed on Saturday that malicious servers could slip fake payments into users' wallets and then collect when the victim raised the fee. Developers confirmed at least one theft and released version 4.8.3, but older versions stay exposed when connected to hostile servers.
A routine fee increase became the moment of theft
Electrum, one of Bitcoin's oldest software wallets, disclosed a security flaw on Saturday that let malicious servers trick users into signing payments to attackers. CoinDesk reported that developers verified a theft in at least one instance and that some servers were already using the weakness against users.
The trap sprang when users tried to speed up a payment that had not yet confirmed. The Defiant summarized the same mechanism in its brief report. A server could substitute a fake payment, and the user would then sign it while believing they were only paying a higher fee. The Defiant also said developers reported that one user lost money.
How the substitution worked
Electrum is a light wallet. Unlike a full Bitcoin node, it relies on outside servers to fetch transaction histories and to broadcast payments. CoinDesk reported that, before the fix, Electrum accepted what servers said about unconfirmed payments and did not check the signatures on them.
That trust gave an attacker who controlled a server an opening. A server could hold back a payment before the Bitcoin network saw it and put a counterfeit transaction in its place in the wallet's record. The fake spent the user's coins to an address the attacker controlled and carried invalid signatures that Electrum failed to detect.
The wallet then displayed the fake payment as pending. Bitcoin lets users replace an unconfirmed transaction with a version that pays a higher fee, a feature called Replace-by-Fee. CoinDesk reported that when a user picked that option, the wallet could build a properly signed replacement from the forged transaction, and that replacement paid the attacker.
Key details from the disclosure
CoinDesk's account contains several specifics that show how the attack was built to avoid notice.
- In one reported instance the fake transaction paid zero fee, so it seemed stuck and prompted a fee increase.
- Attackers created destination addresses ending in the same four characters as the genuine one, which made the swap harder to notice on a brief look.
- The first report arrived on Oct. 11 from a user whose multisignature wallet required two of three keys, held on two Trezor hardware devices. That user did not report any loss.
- A second user wrote on Oct. 18 that raising the fee on a swapped transaction had cost them money.
- The developers have not said how much was taken or which servers were malicious.
- Version 4.8.3 came out on Oct. 24 and verifies signatures on unconfirmed transactions that spend the user's own coins.
What the two outlets report, and where they stop
The two outlets agree on the core of the story. Both describe a malicious server substituting a payment, both tie the loss to a fee increase, and both say a user reported losing money. The Defiant's coverage consists only of a headline and summary, so it cannot be used to confirm dates, versions or the technical steps.
CoinDesk supplies the rest. It reports that developers received two reports in October, names the version that fixes the flaw, and says older releases can still be attacked this way if they connect to malicious servers. Its wording of "at least one" confirmed theft is more cautious than a flat count, and it says the stolen amount has not been disclosed.
One timing detail needs careful reading. CoinDesk describes the fix as arriving within days of the first reported theft. The dates it gives show that the loss was reported on Oct. 18, while the Oct. 11 reporter did not report losing funds. The Oct. 24 patch therefore came after the Oct. 18 loss report.
Why checking a hardware device was not enough here
The first reporter had verified the legitimate payment on both Trezor devices. That user afterward spotted an unfamiliar outgoing payment listed in the wallet. CoinDesk does not say the hardware devices were bypassed, and it does not say how that user's wallet was affected beyond that history entry.
In general terms, a signing device can only confirm the transaction put in front of it. If wallet software shows a substituted payment as pending and then builds a replacement from it, the person approving may believe they are approving something familiar. The near-identical receiving addresses CoinDesk described make that kind of mistake easier.
Steps developers say users should take
Electrum's developers recommend upgrading to version 4.8.3. They also advise checking receiving addresses and amounts carefully before signing any payment, including a fee increase on a pending one, as CoinDesk noted.
Exposure depends on which servers a wallet talks to. CoinDesk reported that people whose wallets talked solely to servers they trusted, such as ones they operate, faced no exposure to this attack. Anyone who used an older version while connected to servers they did not control may want to review their transaction history for outgoing payments they do not recognize.
Open questions after the patch
Several points remain unanswered in the reporting. Developers have not said how much was stolen, how many servers were involved, or who operates them. It is also unclear whether more users were affected than the two who reported problems in October.
Readers should watch for a fuller post-mortem from Electrum and for any identification of the malicious servers. Both would show whether the two reports were isolated cases or the visible part of a wider campaign.
Market snapshot
| Asset | Price | 24h | 7d | Market cap |
|---|---|---|---|---|
| Bitcoin (BTC) | $80,188 | -0.2% | -2.9% | $1.61 trillion |
CoinGecko data as of 2026-10-26 (UTC).
FAQ
What was the Electrum wallet vulnerability?
Before version 4.8.3, Electrum accepted servers' word on unconfirmed payments and did not check the signatures on them. A malicious server could swap in a fake payment, and a user who raised the fee on it could end up signing a valid transaction that sent coins to the attacker. CoinDesk reported that at least one person lost bitcoin.
How do Electrum users protect themselves?
Developers recommend moving to version 4.8.3 and reviewing receiving addresses and amounts prior to signing. CoinDesk reported that people whose wallets used only servers they trusted, such as their own, faced no exposure to this attack.
Has the amount stolen been disclosed?
No. CoinDesk reported that the developers have not said how much was taken or which servers were malicious. They confirmed at least one case of theft among two reports received in October.
Sources
- CoinDesk: Bitcoin wallet bug let rogue servers steal funds when users tried to speed up payments (2026-10-26)
- The Defiant: Electrum Patches Wallet Flaw Exploited Through Malicious Servers (2026-10-24)
- CoinGecko (market data)
Written by the Coinvote news desk from reporting by CoinDesk and The Defiant. Not financial advice.
