Electrum 4.8.3 security update: what bitcoin users should do

Electrum, one of the oldest bitcoin wallets, has released version 4.8.3 and marked it as a security update, crediting fixes to reports from four outside researchers. The release notes are dated 23 October 2026, and signed binaries appeared on the project's download server on 24 October. According to ChainCatcher, the developers urged all users to upgrade and said details of the issue will be published later.

What changed

The notes credit researchers dannydeezy, tokenistq, Raju-K12 and Amadeus29. The team does not say which change closes which report, but the list includes several hardening fixes:

• Plugins: stricter validation of plugin metadata, and ZIP plugins are now loaded from the exact bytes whose signature was checked.
• Lightning: stricter parsing of BOLT11 invoices, extra checks on incoming payments before opening an experimental just-in-time channel, and a fix for a race condition that could make wallets miss on-chain channel backups.
• Signing: Electrum stops signing an input that already carries a witness, and descriptor and BIP32 path parsing are stricter.
• Interface: rich-text rendering of strings is now off by default.
• Certificates: bundled certificate packages were bumped to distrust the revoked eMudhra/emSign root, the authority whose crackable keys we covered this week.

The release also adds mempool.space as an exchange-rate source and fixes a string of Android crashes.

Third security release since August

Version 4.8.1 in August and 4.8.2 on 11 September were also flagged as security updates; 4.8.2 fixed Lightning backups that could miss a key needed to recover anchor-channel funds. If you use Electrum's Lightning features, read our explainer on how the Lightning Network works to understand why channel backups matter.

How to upgrade safely

• Download only from electrum.org (or Google Play / F-Droid on Android) and verify the GPG signature. The current binaries are signed by ThomasV, SomberNight and two other builders.
• Ignore "update" prompts that appear inside the app, in emails or in ads. In 2018–2019 attackers ran malicious Electrum servers that pushed fake update messages linking to malware.
• Upgrading does not change your wallet file or seed phrase, and nobody legitimate will ever ask you for it.
• For larger balances, consider pairing Electrum with a hardware wallet, so the keys never sit on the computer.

The timing fits a wider trend: Bitcoin Core has just rewritten its disclosure policy because AI tools make bugs easier to find.