Malicious Electrum Servers Steal Bitcoin by Baiting Users Into Fee Bumps

Electrum users on any version before 4.8.3 who connect to public servers should upgrade to 4.8.3, which shipped Oct. 24 after at least one user lost funds to the attack. Raising the fee on a slow bitcoin payment is meant to rescue it. In at least one case involving the Electrum wallet, it handed the money to an attacker. Electrum’s developers published a security advisory on Oct. 24. The developers label the flaw high severity and report it being exploited in the wild. Every Electrum release before version 4.8.3 is affected.