Electrum Fixes Bitcoin Wallet Flaw That Could Turn A Fee Bump Into Theft

Electrum disclosed a wallet flaw on October 24 that could turn a Bitcoin fee adjustment into an unintended payment. Its advisory explains how an apparently routine approval became dangerous. TL;DR Version 4.8.3 fixes the flaw. Downloads are available from Electrum’s official site. Each transaction approval still needs its destinations and amounts checked. The dangerous moment came after the original payment The developer advisory describes malicious servers substituting an unconfirmed wallet-history entry. A user who then approved a replacement transaction to raise its fee could authorize payment to an attacker. Developers reported two affected users, including one who lost money; the disclosure does not establish a total loss figure. That distinction makes the incident different from someone simply stealing a private key. The wallet owner could make the correct initial payment and still encounter a dangerous second signing request. Checking an address once does not authenticate every transaction a wallet might subsequently ask the owner to approve. Electrum’s documentation explains the underlying trade-off. Its lightweight client uses servers to retrieve transaction information, i...