TL;DR
Get business pricing on office and shipping supplies
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
Electrum disclosed a vulnerability that reportedly let malicious servers replace a pending payment in the wallet’s history with a fraudulent one. Users who tried to speed up that transaction with Replace-by-Fee could approve a replacement that sent funds to an attacker. Electrum has issued an update with signature checks; older versions remain vulnerable when connected to malicious servers.
Electrum has disclosed a vulnerability in its bitcoin wallet software that reportedly allowed malicious servers to alter how pending payments appeared, potentially tricking users into approving transactions that sent funds to attackers. The wallet’s developers have issued an update with new signature checks, while earlier versions remain vulnerable when connected to malicious servers, according to reporting by CoinDesk and PYMNTS.
CoinDesk reported on Monday, October 26, that Electrum disclosed the issue over the weekend and said some servers had begun exploiting it. Developers had received two reports that month, including one from a user who lost money after approving what appeared to be a routine transaction-fee increase. The reports establish that losses were described, but the source material does not give a total amount or identify the affected servers.
Electrum relies on outside servers to retrieve transaction histories and broadcast payments rather than operating as a full bitcoin node. Before the fix, the wallet accepted information from those servers about pending transactions without verifying their signatures. A server controlled by an attacker could reportedly intercept a payment before it reached the bitcoin network and replace its entry in the wallet’s history with a fraudulent pending transaction.
The trap depended on users trying to speed up the displayed transaction. Bitcoin’s Replace-by-Fee (RBF) feature allows an unconfirmed transaction to be replaced by one with a higher fee. According to the report, Electrum could use the fraudulent transaction to approve a valid replacement that directed the funds to the attacker. The updated software adds signature checks for unconfirmed transactions spending coins from the user’s own wallet. Electrum’s developers advise users to upgrade and check receiving addresses and amounts before signing.
How a Fee Increase Became a Payment Risk
The incident illustrates a risk at the point where a wallet displays transaction information and asks a user to approve an action. The bitcoin network’s cryptography was not reported to have been broken; instead, the vulnerability involved unverified information from a server being presented in a way that could lead to a misleading approval. For users, a familiar option to increase a transaction fee could become dangerous if the transaction details shown by the wallet had been manipulated.
The reported attack also highlights the security trade-off involved in relying on outside servers. Those servers help Electrum retrieve transaction data and broadcast payments, but the reported flaw meant the wallet did not adequately check the authenticity of certain pending-transaction information. Installing the update and verifying payment details are practical protections identified by the developers. The available reporting does not establish how many users or servers were affected, so the full scope of exposure remains unknown.
Products Worth Considering
Logitech MX Mechanical Full-Size Wireless Mechanical Keyboard, Tactile Quiet Switches, Backlit Keys, Bluetooth, USB-C, Multi-Device, Graphit
Logitech MX Master 4 for Mac, Ergonomic Bluetooth Mouse with Haptic Feedback, Ultra-Fast Scrolling, USB-C Charging, for MacOS, iPadOS, Windo
Logitech MX Keys S Wireless Keyboard, Graphite
As an affiliate, we earn on qualifying purchases.
Electrum’s Server-Based Transaction Model
Electrum is a software wallet that uses external servers to access transaction histories and send payments. The reported vulnerability concerned how the wallet handled information about pending transactions, not a reported failure of bitcoin’s underlying encryption or a reversal of confirmed blockchain transactions. The distinction matters: the described attack sought to manipulate what a user saw and signed before a payment was confirmed.
The report places the disclosure amid other recent crypto-security incidents. PYMNTS said Ledger had announced an investigation earlier in October into a hack that siphoned $90 million from its devices. It also referred to a Coinkite hardware-wallet software flaw reported during the summer. These are separate incidents and do not establish that Electrum’s flaw used the same method. The relevant common point is that wallet security can depend on software and transaction handling, not only on keeping private keys offline.
“Some servers had begun exploiting the vulnerability.”
— Electrum, as described in the CoinDesk report
Scope of the Reported Exploitation
The available reports do not state how many users lost funds, the total value of any losses, or which Electrum servers were involved. They also do not specify how many users remain on vulnerable versions or whether every older release is affected in the same way. The reported two developer reports this month include one loss report, but that figure does not establish the total number of victims.
Further technical details, including how the malicious servers were controlled and whether other transaction patterns could be affected, are not provided in the source material. Electrum’s update is reported to add checks for unconfirmed transactions that spend users’ own coins; the reporting does not describe additional safeguards or independently verify the fix’s effectiveness.
Upgrade and Verify Pending Payments
Electrum users should follow the developers’ reported guidance to install the updated version and carefully confirm the receiving address and amount before signing any payment, especially when asked to raise a fee on an unconfirmed transaction. Users on earlier versions should not assume that a pending transaction shown by a connected server is safe to approve.
The next public developments to watch for are any further technical details from Electrum, information about the servers involved, and updates on the number of affected users or losses. The source reports no timeline for additional disclosures or a separate investigation. Until those details emerge, the confirmed picture is limited to the disclosed flaw, reports of exploitation, and the release of an update.
Key Questions
What did the Electrum vulnerability do?
According to CoinDesk’s report, a malicious server could alter how a pending payment appeared in Electrum’s transaction history. A user attempting to raise the fee could then approve a replacement payment directed to an attacker.
Did the flaw break bitcoin’s encryption?
The reports describe a problem with Electrum’s handling of information from outside servers, not a break of bitcoin’s encryption or a reversal of confirmed blockchain transactions.
Has Electrum released a fix?
Yes. The report says Electrum issued an update adding signature checks for unconfirmed transactions that use coins from the customer’s wallet. Earlier versions remain vulnerable when connected to malicious servers, according to the reporting.
What should Electrum users do?
Electrum’s developers reportedly advise upgrading and checking the receiving address and amount before signing. Users should take particular care when approving a fee increase for a pending transaction.
How many users were affected?
The source material does not provide a total. CoinDesk reported that developers had received two reports that month, including one from a user who lost money, but that does not establish the full number of affected users or losses.
Source: pymnts.com
