Electrum 4.8.3 Security Update: How to Stop the Bitcoin Fee-Bump Attack

A malicious Bitcoin wallet server can make a genuine payment disappear from Electrum’s transaction history and replace it with a fake payment to an attacker. If the user then tries to speed up the apparent stuck transaction, they may unknowingly sign a transaction that sends their bitcoin to the attacker instead. On October 24, 2026, Electrum disclosed that this technique was being used in the wild and released version 4.8.3 to fix the flaw. Anyone using an older version should update before attempting to increase the fee on a pending payment.

Electrum 4.8.3 fixes an attack that exploits trust in wallet servers

Electrum is a Bitcoin wallet designed to let users manage funds without downloading and independently validating the entire Bitcoin blockchain. Instead, it relies on external servers for information such as transaction history and the status of unconfirmed payments. This lightweight design makes the wallet practical to use, but it also means the software must carefully distinguish information supplied by a server from transactions it has verified itself.

According to Electrum developer SomberNight’s security advisory, versions before 4.8.3 could accept a malicious server’s false representation of an unconfirmed outgoing transaction without checking the signatures on the replacement. A transaction signature proves that the required keys authorised the transaction’s contents. Without the relevant checks, the wallet could display a conflicting transaction that redirected the payment while appearing to show the user’s own activity.

The project rated the vulnerability High and assigned it the identifier GHSA-6jp4-8v48-cc5v. No Common Vulnerabilities and Exposures (CVE) number was listed in the advisory. The fix was included in version 4.8.3, tagged on October 23, with downloadable binaries released the following day.

How the malicious server turns a fee increase into a theft

The attack takes advantage of a familiar situation: a Bitcoin payment that remains unconfirmed longer than expected. Bitcoin’s Replace-by-Fee (RBF) feature lets users replace an eligible pending transaction with a new version offering a higher fee, giving miners a stronger incentive to include it in a block. In a normal transaction, the replacement preserves the intended payment while adjusting the fee. In this attack, the wallet can be tricked into starting from a fraudulent transaction instead.

The sequence described by Electrum is specific. First, the user broadcasts a legitimate payment, but the malicious server withholds it from the wider Bitcoin peer-to-peer network. The server then supplies a conflicting transaction that changes the destination to an address controlled by the attacker. Because the vulnerable wallet does not validate the relevant signatures before displaying that unconfirmed transaction in its history, the false payment can appear to be the user’s real transaction.

The theft happens when the user tries to fix the apparent delay. If they choose to increase the fee, Electrum can construct and sign a replacement based on the fraudulent transaction. That new transaction carries valid signatures and can spend the user’s funds to the attacker. The user may never have entered the attacker’s address; the dangerous decision was approving a fee increase without recognising that the underlying transaction had changed.

Two user reports show that the attack was not merely theoretical

Electrum’s advisory describes two reports received privately from users. The first, submitted on October 11, 2026, described a transaction history that changed after a payment was broadcast. The second report arrived on October 18 and involved a user who lost funds after increasing the fee on the substituted transaction. The developers said some servers were carrying out the attack in the wild.

Both reports included a detail that makes the deception harder to spot during a quick check: the attacker’s destination address was crafted to share the final four characters of the intended recipient’s address. One reported fake transaction also had a zero fee, which the developers suspected was intended to encourage the victim to try a fee increase. A matching address suffix is not proof that a destination is correct, and a transaction appearing in wallet history is not, by itself, proof that it was accepted by the Bitcoin network.

The advisory does not identify the malicious servers, quantify the amount stolen, or establish how many additional users may have been affected. It also does not say that funds lost in the reported incident have been recovered. Those limits matter: the disclosure confirms exploitation and at least one reported financial loss, but it does not establish the overall scale of the campaign.

What Electrum 4.8.3 changes — and what it does not

The patch adds signature verification for unconfirmed transactions that spend inputs belonging to the user’s own wallet. Electrum now checks those signatures before adding the transaction to its local history, preventing the specific forged outgoing-payment scenario described in the advisory. For users on vulnerable releases, moving to 4.8.3 closes this known attack path.

The fix does not turn Electrum into a full Bitcoin node. The wallet still does not independently validate every aspect of every unconfirmed transaction; the new checks cover wallet-owned inputs, while incoming unconfirmed transactions are not covered by the same validation. That is a meaningful security improvement, but not a promise that all server-supplied information is now independently verified. Users who connect exclusively to servers they trust, including servers they operate themselves, were not affected by this particular attack, according to the project.

How to update Electrum and check a pending Bitcoin payment

Electrum’s official website lists version 4.8.3 as the current release. Download the update from the project’s official site rather than from search advertisements, unsolicited messages, or third-party download pages. The project also recommends verifying the download’s GPG signature, a cryptographic check that helps confirm the installer matches a release signed by an authorised developer.

If you cannot update immediately, treat any pending outgoing transaction with caution. Electrum’s advisory recommends checking the output addresses and amounts before signing any transaction, whether or not you are increasing its fee. Check the complete destination address, not just the first or last few characters, and compare the amount against the payment you intended to make.

• Update: Install Electrum 4.8.3 or a later version once available from the official project source.
• Verify: Check the download’s signature rather than trusting a file simply because it is labelled as an Electrum installer.
• Inspect: Before approving a fee increase, confirm the complete destination address and the amount being sent.
• Investigate: If the transaction history changes unexpectedly after broadcasting, do not try to repair it by blindly raising the fee. Verify the transaction independently and seek help through trusted project channels.

Anyone who suspects that they already signed a fraudulent replacement should preserve the transaction details and review the confirmed activity in a reliable Bitcoin block explorer or through a trusted node. If a transaction has confirmed to an attacker-controlled address, the blockchain generally does not provide a mechanism to reverse it; a wallet update prevents the disclosed exploit but does not automatically recover funds already sent.

The larger lesson is that a wallet display is not the same as network confirmation

This incident exposes a difficult trade-off in lightweight wallets. Relying on external servers makes transaction information convenient to retrieve, but it also creates a trust boundary that users may never see. The problem was not a stolen seed phrase or a counterfeit wallet application: it was a malicious server supplying deceptive transaction data to a genuine, unmodified wallet, followed by a user action that converted the deception into a valid payment.

For Electrum users, the immediate step is clear: update to 4.8.3 and be especially careful with pending transactions that suddenly show a different destination. For wallet developers, the disclosure is a reminder that checks applied to confirmed blockchain activity do not automatically protect every unconfirmed transaction shown to a user. The next thing to watch is whether Electrum publishes further details about the scope of the attack or extends verification beyond the outgoing transactions covered by this patch.