Electrum Bitcoin wallet · Exploitation reported

Electrum 4.8.3 Fixes Flaw Exploited to Steal Bitcoin

Oct 23, 2026 · 1 min read

A malicious Electrum server could replace a just-broadcast transaction with one that diverted the bitcoins, then trick the user into signing it during a fee increase (Replace-By-Fee). The high-severity flaw was exploited and one user reported losing funds to the developers. Version 4.8.3 fixes the issue; upgrade immediately, download only from electrum.org, and check the destination address before signing.

By HIFY Radar newsroom Updated 10/26/2026 02:38 PM Get this every day →← Back to the feed 4 sources

HighVulnerabilityExploitation reportedPatched

In this article

What happened
Why it matters
What to do
For the technical team
Timeline
Sources

What happened

The Electrum Bitcoin wallet released version 4.8.3 to fix a critical flaw. A malicious server could swap a user's transaction with one that diverted the funds and get the user to authorize the theft while trying to raise the fee. One user lost money, according to the developers.

Why it matters

Every version before 4.8.3 is affected. The theft relies on the victim's own valid signature, disguised as a routine fee increase, and attacker addresses mimic the end of the original address, making the switch hard to notice. Users of public Electrum servers are exposed.

What to do

Upgrade the wallet to version 4.8.3 immediately, downloading only from electrum.org and verifying the file signature. Until then, check the destination address and amount before any signing, including fee increases. The Windows Defender warning about ZXing.dll in this release is a false positive, according to Electrum.

For the technical team

Affected: Electrum Bitcoin wallet · Electrum < 4.8.3 (all versions prior to 4.8.3, per advisory GHSA-6jp4-8v48-cc5v).
Exploitation: Exploitation reported by Bitcoin.com News and The Defiant, with funds stolen. dannydeezy reported transaction substitution on October 11, 2026, with the fee-bump mechanism not fully understood; Raju-K12 reported losing funds on October 18, 2026 after approving a fee increase, confirming the attack was real.
Fix: Upgrade to Electrum 4.8.3, released October 23, 2026 per the release notes. Commit 90fe308 requires signature verification for unconfirmed transactions spending wallet coins; invalid-signature transactions are rejected before entering local history. Download only from electrum.org and verify cryptographic signatures. Mitigation before upgrading: inspect the destination address and amount before signing, including fee bumps; connecting only to trusted self-hosted servers removes exposure to this attack.
Vector: Electrum wallet on a version before 4.8.3 connected to a malicious server. Older versions accepted certain unconfirmed transactions without verifying signatures: the server intercepted the payment, blocked its broadcast, and substituted a fraudulent transaction with invalid signatures, displayed as an ordinary pending payment. When raising the fee via RBF, the victim signed the substituted transaction and authorized the transfer to the attacker. Attacker addresses repeated the final four characters of the intended destination; one fraudulent transaction carried a zero fee, apparently to prompt the victim into the fee bump.
More details: Advisory GHSA-6jp4-8v48-cc5v, high severity. Release 4.8.3 also bundles undisclosed security fixes credited to tokenistq and Amadeus29. Electrum's official X account confirmed on October 26, 2026 that the version fixes the critical flaw and urged all users to upgrade immediately.

Timeline

10/26/2026 02:38 PM
Electrum's official account confirms version 4.8.3 fixes a critical flaw and urges all users to upgrade immediately.
10/26/2026 01:11 PM
Incident opened.