On this page
Key takeaways
- The developers of Electrum, a long-running Bitcoin software wallet, disclosed a high-severity flaw on October 24, 2026. A malicious server could hide a payment the user had just sent and show a fake pending one that pays the attacker instead.
- The trap springs when the user raises the fee on that fake pending payment to speed it up. Electrum then signs a valid version and the coins go to the attacker. Electrum received two user reports, and one user lost money. It says some servers are doing this in the wild.
- Every version before 4.8.3 is affected. Update from electrum.org, and before you sign any transaction, including a fee bump, check that the address and amount are what you expect.
Electrum, one of the oldest Bitcoin wallet apps, has fixed a flaw that some servers were already using to steal bitcoin. The trick worked when a user tried to speed up a payment that looked stuck. If you use Electrum, update to version 4.8.3 and read the address on every transaction before you sign it.
What happened
Electrum's developers published a security advisory on GitHub on October 24, 2026, rated high severity. They say "some servers are performing this attack in the wild." Their timeline:
- October 11: a first user privately reported that, after sending a payment, the wallet's history showed a different transaction. The fee-bump danger wasn't recognized yet.
- October 18: a second user reported losing money after raising the fee on a transaction.
- October 23: the fix was tagged as version 4.8.3.
- October 24: the 4.8.3 downloads were released and the flaw was made public.
CoinDesk and crypto.news reported the disclosure. CoinDesk noted that the developers haven't said how much was stolen or identified the servers involved.
How the trick worked, in plain English
Electrum is a "light" wallet: instead of downloading the whole blockchain, it asks outside servers about your transactions. Its own FAQ says confirmed transactions are checked, but "the server is trusted about unconfirmed transactions." The attack abused that gap:
- You send a payment. A malicious server quietly holds it instead of passing it on to the Bitcoin network.
- The server tells your wallet about a different, fake pending transaction that sends your coins to the attacker. Its signatures are invalid, but older Electrum versions didn't check.
- Your wallet shows the fake transaction as pending, and your real one disappears from view. In one case it carried no fee at all, so it looked stuck.
- You click "Increase fee" to speed it up. Electrum signs a new, valid version, and that one really does pay the attacker.
Raising the fee on a stuck payment is a normal Bitcoin feature called Replace-by-Fee (RBF), and Electrum makes payments replaceable by default. Both users said the attacker's address was made to match the last four characters of the real one, so a quick glance at the ending wouldn't catch it. That's the same idea behind address poisoning.
What the fix does, and its limits
Version 4.8.3 makes Electrum check the signatures on pending transactions that spend coins from your own wallet before it shows them. The developers say every version before 4.8.3 is vulnerable, and that people who connect only to servers they trust, such as their own, were not affected.
The advisory is also clear about a limit: even after the fix, Electrum still only checks pending transactions that spend from your own addresses. Incoming pending payments aren't checked, because a light wallet can't fully verify them. A payment someone says they sent you isn't final until it confirms.
What Electrum users should do
- Update to 4.8.3 from electrum.org, typed into your browser yourself. Don't follow download links in emails, ads or direct messages: fake wallet downloads are a common scam.
- Read the whole address and the amount before you sign anything, including a fee bump. Electrum's developers give this check as the safeguard for anyone who can't update yet. On a hardware wallet, do it on the device's own screen.
- Be suspicious if your wallet history shows a payment you don't recognize, especially one with no fee or the wrong destination. Don't bump it. Stop and check it in a block explorer.
- Don't confuse "pending" with "done." Unconfirmed payments, coming in or going out, can still change.
New to wallets? Our guide to how crypto wallets work explains the difference between app, hardware and exchange wallets.
The takeaway
This flaw didn't touch anyone's seed phrase. It worked by making a fake payment look real and waiting for the user to sign. Updating closes this hole, and the habit that protects you from the next one is the same: check the address and amount yourself before you approve any transaction. This is education, not financial advice, and it reflects Electrum's advisory and news reports as of October 26, 2026.
Frequently asked questions
Do I use Electrum?
Electrum is a Bitcoin wallet app you install yourself. If you only hold bitcoin on an exchange such as Coinbase or Kraken, this advisory doesn't apply to you. It covers the Electrum app itself, not other wallet apps. Some hardware wallet owners use Electrum as the app on their computer, and CoinDesk reported that one of the two reports involved a multisignature wallet using two Trezor devices.
Does a hardware wallet protect me from this?
Not fully. The hardware wallet shows you what you are about to sign, and that is your defense. If you approve a fee bump without reading the destination address on the device screen, you can still sign a payment to the attacker. The attacker's address was made to end in the same last four characters as the real one, so check more than the ending.
Was my seed phrase exposed?
Nothing in Electrum's advisory says so. The attack doesn't steal keys or recovery phrases. It tricks the wallet into showing a fake pending payment, so that the user signs a payment to the attacker. That is why reading the address and amount before signing matters.
Who was affected?
Electrum says it got two private reports in October and that one user lost money after bumping a fee. CoinDesk reported that the developers haven't disclosed how much was stolen or which servers were involved. People who connect only to servers they trust, such as their own, were not affected, according to the advisory.
Sources
- Malicious server can replace a just-broadcast tx and try to trick user into RBF-ing it (GHSA-6jp4-8v48-cc5v) (opens in a new tab) — Electrum developers on GitHub
- Electrum release notes: Release 4.8.3 (security update) (opens in a new tab) — Electrum developers on GitHub
- Frequently Asked Questions: Does Electrum trust servers? (opens in a new tab) — Electrum documentation
- Bitcoin wallet bug let rogue servers steal funds when users tried to speed up payments (opens in a new tab) — CoinDesk
- Electrum wallet fixes security flaw after hackers steal Bitcoin (opens in a new tab) — crypto.news
Published October 26, 2026 by Dave McNaught. Educational content, not financial, legal or tax advice. Spot an error? Request a correction.
Dave McNaught
Dave McNaught has worked in IT since 1999 and founded All Business Technologies (ABT) in 2003, a Boston-area firm providing Managed IT, Cybersecurity, Managed AI, Web Design and App Development. He publishes The Crypto Guide.