Key facts
- Electrum wallet version 4.8.3 patches a critical vulnerability.
- Malicious servers could inject fake transactions to redirect funds.
- The exploit tricked users into paying attacker addresses.
- At least one user confirmed losing funds on October 18.
- The fix verifies signatures on wallet-owned inputs before displaying unconfirmed transactions.
Bitcoin wallet Electrum has released version 4.8.3 to address a high-severity vulnerability that allowed malicious servers to manipulate pending transactions and redirect funds to attacker-controlled addresses. The exploit, which affected all versions prior to 4.8.3, tricked users into signing new transactions that paid attackers. At least one user reported a confirmed loss of funds on October 18 after falling victim to the attack. The patch verifies cryptographic signatures on wallet-owned inputs before displaying unconfirmed transactions, preventing servers from injecting fake transactions without valid signatures. However, incoming transactions from external senders still require manual verification.