Bitcoin wallet Electrum patches fee-increasing theft vulnerability

On October 24, Bitcoin lightweight wallet Electrum publicly disclosed a malicious server attack exploiting the transaction fee-bumping mechanism and patched it in version 4.8.3. A related security advisory has been published on GitHub under ID GHSA-6jp4-8v48-cc5v. The vulnerability caused users’ fund signatures to be hijacked during routine fee-bumping operations, redirecting funds to addresses controlled by attackers. The flaw was discovered following user reports of anomalous fund losses. Developers confirmed initially receiving two similar yet distinct incident reports: one from a user who, after broadcasting a payment, noticed the original transaction had been silently replaced in their wallet’s transaction history—and that this original payment never entered the Bitcoin peer-to-peer network, suggesting server-side interception; the other report came from user Raju-K12, who lost funds immediately after performing a fee bump on a transaction that had already been replaced. The attack works as follows: a malicious server intercepts the client’s newly broadcast fee-bumped transaction, refuses to relay it to the blockchain, and instead injects a conflicting forged transaction into the user’s wallet history—altering the output address of the original transaction to point to an attacker-controlled address. Although this forged transaction’s signature is invalid at injection time, …