Electrum Wallet Flaw Allowed Servers To Trick Users Into Paying Hackers

Trusted Editorial content, reviewed by leading industry experts and seasoned editors. Ad Disclosure Electrum, one of Bitcoin’s oldest software wallets, published a security advisory on Saturday describing a weakness that attackers were already abusing. TL;DR A bug in the Electrum bitcoin wallet let malicious servers slip fake pending payments into users’ transaction history. Users who tried to speed up a stuck payment with Replace-by-Fee could end up signing coins over to the attacker. At least one user lost funds. Electrum released version 4.8.3 on October 24, and the amount stolen remains undisclosed. Users connected only to servers they trust, including their own, were not exposed. The Wallet Allowed Fake Pending Payments The developers had received two reports during October. One came from a user who lost money after approving what looked like an ordinary fee increase. The issue lies in how the wallet handles payments that the network has not yet confirmed. Unlike a full Bitcoin node, Electrum depends on outside servers to supply transaction histories and relay payments. Before the patch, it accepted those servers’ reports about pending transactions without checking their signa...