TL;DR
Get business pricing on office and shipping supplies
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
Electrum disclosed a vulnerability after developers received two reports this month, including one from a user who said they lost funds. The wallet has issued an update that checks signatures on certain unconfirmed transactions, but older versions remain vulnerable when connected to malicious servers.
Electrum has disclosed a vulnerability in its Bitcoin wallet software after some servers reportedly began exploiting it, a flaw that could trick users into signing payments to attackers. The wallet has issued an update with new signature checks, but older versions remain vulnerable when connected to malicious servers, according to a CoinDesk report cited by PYMNTS.
Electrum developers received two reports this month, CoinDesk reported. One came from a user who lost money after approving what appeared to be a routine request to increase a transaction fee. The reports and server exploitation were described in the coverage; the full extent of losses and the number of affected users were not provided.
Electrum retrieves transaction histories and broadcasts payments through outside servers, rather than operating as a full Bitcoin node. Before the fix, the wallet reportedly relied on those servers to report pending transactions without checking their signatures. A server controlled by an attacker could intercept a payment before it reached the Bitcoin network and replace the wallet’s displayed history with a fake pending transaction.
The trap could be triggered when a user tried to speed up that apparent transaction using Replace-by-Fee, a Bitcoin feature that allows an unconfirmed transaction to be replaced by one with a higher fee. According to the report, Electrum could then approve a valid replacement that sent the funds to the attacker. The update adds signature checks for unconfirmed transactions that use coins from the customer’s own wallet. Electrum’s developers advise users to upgrade and check receiving addresses and amounts before signing.
How a Fee Increase Could Redirect Funds
The reported flaw matters because a familiar wallet action—raising a fee to speed up a pending payment—could be used to authorize a different destination. Users may have believed they were updating their own transaction while the wallet was acting on information supplied by a server. That makes the destination address and payment amount important checks, not just the fee shown on screen.
The incident also illustrates a risk in relying on external infrastructure for transaction data. Electrum’s use of outside servers does not mean every server is malicious, and the report does not say all users were exposed or affected. But the vulnerability shows how a compromised or hostile server could influence what the wallet displays before a transaction is confirmed, with potential loss of funds once a user signs and broadcasts a payment.
The account describes a software and transaction-verification failure. It does not report that Bitcoin’s encryption was broken or that the blockchain was reversed. For users, the immediate practical distinction is that updating the wallet addresses the described flaw, while signing without checking transaction details can still carry risks.
Popular right now
Vitamix 5200 Professional-Grade Blender, 64 oz. Container, Black
Dyson Cyclone V10 Origin Cordless Vacuum
Dyson Big Ball Multi Floor Canister Vacuum, Yellow
As an affiliate, we earn on qualifying purchases.
Electrum’s Server-Based Transaction Model
Electrum is a Bitcoin software wallet that uses external servers to retrieve transaction histories and broadcast payments. As described in the CoinDesk report, the vulnerability involved the wallet trusting server-provided information about pending transactions without verifying signatures. The reported attack therefore depended on a malicious server and a user action; the source does not say that every Electrum server or every transaction was affected.
Bitcoin’s Replace-by-Fee feature is designed to let users replace an unconfirmed transaction with one carrying a higher fee. In the reported scenario, that ordinary function became the point at which a user could be misled into approving a payment to an attacker. Electrum has added checks for unconfirmed transactions using coins from the user’s wallet, but the source says older versions remain susceptible when connected to malicious servers.
The report places the Electrum disclosure amid other recent cryptocurrency security incidents. It says Ledger announced an investigation earlier in October into a hack that siphoned away $90 million from its devices, and refers to a separate Coinkite software flaw disclosed over the summer. Those cases involve different products and circumstances; the source does not establish a connection between them and the Electrum vulnerability.
“Developers had received two reports this month, including one from a user who lost money after approving what seemed to be a typical transaction fee increase.”
— Electrum developers, as described in the CoinDesk report cited by PYMNTS
Scope of the Exploitation Remains Unknown
The available reporting does not identify the malicious servers, explain how they were compromised or controlled, or specify how many people connected to them. It also gives no total value for losses tied to the Electrum flaw. The account mentions one user who lost money, but does not provide the amount or transaction details.
It is also unclear how widely the vulnerable versions were used, whether additional reports have been received, or whether all forms of unconfirmed transactions were exposed in the same way. The source says the update adds checks for unconfirmed transactions using coins from a customer’s own wallet; it does not provide a full technical advisory or a list of affected software versions.
The reported disclosure says some servers had begun exploiting the vulnerability, but does not establish whether exploitation is continuing after the update. Nor does it say whether users who already installed the fix need to take further steps beyond checking transaction details. Those questions may depend on information from Electrum’s developers that is not included in the cited account.
Users Should Update and Verify Payments
Electrum users should install the wallet update, following the developers’ reported guidance, and verify the receiving address and amount shown before signing a payment. Users on older versions face the reported risk if they connect to a malicious server. The source does not give a specific update number or instructions for identifying a compromised server, so users should consult Electrum’s official release and security information for version-specific details.
Further information from Electrum could clarify which versions are affected, the scope of server exploitation, and whether more users have reported losses. Until those details are available, the confirmed account is limited: developers received two reports this month, one user reportedly lost money, an update adds signature checks for a defined class of transactions, and older versions remain vulnerable in the stated circumstances.
Key Questions
What did the Electrum wallet bug allow attackers to do?
According to the report, a malicious server could supply a fake pending transaction in the wallet’s history. If a user tried to raise its fee using Replace-by-Fee, the wallet could approve a replacement that sent funds to the attacker.
Has Electrum released a fix?
Yes. The report says Electrum issued an update that adds signature checks for unconfirmed transactions using coins from the customer’s own wallet. Older versions remain vulnerable when connected to malicious servers.
How many users lost money?
The cited reporting describes two reports received by developers this month, including one from a user who lost money. It does not state the total number of affected users or the value of the reported loss.
What should Electrum users check before signing?
Electrum’s reported guidance is to upgrade and check the receiving address and payment amount before signing. The source does not provide a specific version number or additional recovery instructions.
Source: pymnts.com
