Electrum Patches a Wallet Flaw That Let Rogue Servers Turn Fee Bumps Into Theft
A Fee Bump That Sent Your Bitcoin to an Attacker
Electrum, one of Bitcoin’s oldest and most widely used lightweight wallets, disclosed a high-severity vulnerability on October 24, 2026, and released version 4.8.3 to fix it. The flaw allowed a malicious server to replace a user’s legitimate outgoing transaction with a fraudulent one in the wallet’s transaction history. If the user then tried to speed up the payment by increasing the fee, they would unknowingly sign and broadcast the attacker’s transaction instead, sending their Bitcoin to an address the attacker controlled.
The first complaint arrived on October 11 when a user noticed that a transaction in their wallet history did not match the payment they had originally submitted. A second user reported on October 18 that increasing the fee on a substituted transaction had resulted in stolen funds. Electrum confirmed at least one theft but did not disclose the amount stolen or identify the malicious servers involved.
Why Electrum Was Vulnerable
Unlike a full Bitcoin node, Electrum does not download and verify the entire blockchain. It connects to external ElectrumX servers to retrieve transaction histories and broadcast payments. Anyone can run an ElectrumX server, and the wallet historically trusted its connected server when displaying unconfirmed transactions. That trust is what the attackers exploited: they ran servers that fed users fake transaction data, waited for a user to attempt a fee increase, and captured the signed replacement transaction.
Version 4.8.3 introduces signature validation for unconfirmed transactions that spend coins belonging to the user’s wallet, meaning the wallet now checks whether pending transactions were actually created by the user before displaying them. Users who connected exclusively to their own self-hosted Electrum server were never exposed to this attack.
Another Entry in 2026’s Relentless Security Record
The Electrum disclosure extends a security record that has made 2026 the most punishing year for Bitcoin infrastructure in the space’s history. The Coldcard firmware exploit drained approximately 1,596 BTC from 500 users. SafePal exposed 40,000 customers’ personal data. BitBox patched two severe firmware flaws before exploitation. BTCPay Server patched a critical vulnerability that drained merchant Lightning nodes. Boltz suspended swap services after AI-assisted attacks. The Liquid Network lost $320 million. Alby Hub confirmed a critical vulnerability in older versions. Bitget lost $387 million to suspected North Korean attackers. And now Electrum, a wallet that has been trusted since 2011, joins the list.