Electrum Rogue Servers Stole Bitcoin After Fee Bumps

Electrum rogue servers stole Bitcoin when users raised fees on faked pending payments. The Electrum team shipped 4.8.3 on October 24. The update closes a serious flaw in older builds. Developers confirmed active abuse and at least one reported loss. That is the stake for Bitcoin wallet security. A light client can show a fake send. A manual fee bump can turn it into a real payment to an attacker. According to Electrum's October 24 security advisory, the bug lay in how the wallet handles unconfirmed transactions. Electrum asks outside servers for mempool data. It does not run full Bitcoin checks on every pending entry. Before the patch, a connected server could push pending details without signature checks on the user's own inputs.

First reported by Live Bitcoin News. This page is a short excerpt; the full text is theirs.