Electrum Wallet Flaw Allowed Servers To Trick Users Into Paying Hackers

Electrum, one of Bitcoin’s oldest software wallets, published a security advisory on Saturday describing a weakness that attackers were already abusing. TL;DR A bug in the Electrum bitcoin wallet let malicious servers slip fake pending payments into users’ transaction history. Users who tried to speed up a stuck payment with Replace-by-Fee could end up signing coins over to the attacker. At least one user lost funds. Electrum released version 4.8.3 on October 24, and the amount stolen remains undisclosed. Users connected only to servers they trust, including their own, were not exposed.