Electrum bug let rogue servers steal BTC via fee bumps

Electrum, one of bitcoin's oldest wallets, says a bug fixed in version 4.8.3 let malicious servers trick users into signing away their coins when they tried to speed up a pending payment, and that the flaw was already being exploited. The developers disclosed the issue on Saturday, 24 October, the same day the update shipped, CoinDesk reports.

How the attack worked

Electrum is a "light" wallet: instead of running a full bitcoin node, it asks public Electrum servers for transaction history and uses them to broadcast payments. Until 4.8.3 it took the servers' word for any unconfirmed transaction that spent the user's own coins and did not check the signatures.

• A rogue server could hold back the user's real payment and show a fake pending transaction instead, sending the coins to the attacker with signatures that were invalid but went unnoticed.
• Because the fake was never valid, it never confirmed. In one reported case it carried no fee at all, so it looked stuck.
• When the user pressed bump fee (Replace-by-Fee), Electrum built a new transaction from the fake one and signed it properly, turning it into a valid payment to the attacker.
• The attacker's addresses were generated so that their last four characters matched the real destination, which defeats a quick glance.

Two reports in October

The first report, on 11 October, came from a user of a 2-of-3 multisig wallet with two Trezor devices who noticed an unfamiliar outgoing transaction in their history; that user did not report a loss. A second user reported on 18 October that they had bumped the fee on a substituted transaction and lost money. Electrum has not said how much was stolen or which servers were involved.

Version 4.8.3 adds signature checks for unconfirmed transactions that spend the wallet's own coins. Older versions remain exposed when connected to a malicious server; users connected only to servers they trust, including their own, were not affected. It is the same release we covered on Saturday, which also fixed several other issues and dropped the eMudhra certificate.

What to do

• Update to Electrum 4.8.3 from the official site and check the signature of the download.
• Before signing anything, including a fee bump, read the full address and amount on your hardware wallet screen, not just the first and last characters. Our hardware wallet guide explains why the device screen is the one to trust.
• If you can, connect Electrum to your own server or a single server you trust.
• New to fee bumping? Our guide on how to speed up a bitcoin transaction explains Replace-by-Fee, CPFP and when each is safe.