Malicious Electrum Servers Steal Bitcoin by Baiting Users Into Fee Bumps

Raising the fee on a slow bitcoin payment is meant to rescue it. In at least one case involving the Electrum wallet, it handed the money to an attacker. Electrum’s developers published a security advisory on Oct. 24. The developers label the flaw high severity and report it being exploited in the wild. Every Electrum release before version 4.8.3 is affected. The fix is in version 4.8.3, whose binaries came out Oct. 24. Get Unchained’s crypto news in your inbox with the free Unchained Daily newsletter. Inside the Trick Because Electrum leans on a server for the state of unconfirmed transactions, a dishonest server has room to lie. That trade-off is part of the wallet’s documented design. What the user sees depends on the server.

First reported by Unchained. This page is a short excerpt; the full text is theirs.