Electrum Wallet Bug Let Rogue Servers Steal Bitcoin via RBF

Electrum, one of Bitcoin's oldest software wallets, has disclosed a vulnerability that let malicious servers trick users into signing payments to attackers when they tried to speed up a transaction. The developers confirmed at least one case in which funds were stolen, and said some servers were already exploiting the flaw.

How the attack worked

Unlike a full Bitcoin node, Electrum relies on outside servers to fetch transaction histories and broadcast payments. Before the fix, the wallet trusted those servers to report pending transactions without verifying their signatures.

An attacker running a server could intercept a payment before it reached the network and replace it in the wallet's history with a fake one. That fake transaction spent the user's coins to an attacker-controlled address, using invalid signatures Electrum failed to detect. The wallet then displayed it as pending.

The trap closed when a user chose Replace-by-Fee, the Bitcoin feature that lets unconfirmed transactions be replaced with higher-fee versions. Electrum could take the fraudulent transaction and sign a valid replacement, sending the coins to the attacker. In one case the fake transaction carried no fee, so it looked stuck. Attackers also generated receiving addresses whose last four characters matched the legitimate destination, making a quick check less reliable.

Reports and the fix

The developers received two reports in October. The first, on Oct. 11, involved a two-of-three multisignature wallet using two Trezor devices; the user had verified the legitimate payment on both but later spotted a different outgoing transaction, and did not report losing funds. On Oct. 18, a second user said they had raised the fee on a substituted transaction and lost money. The amount stolen and the malicious servers have not been disclosed.

Electrum 4.8.3, released Oct. 24, adds signature checks for unconfirmed transactions that spend coins from the user's own wallet. Earlier versions remain vulnerable when connected to malicious servers.

Users should upgrade and carefully verify receiving addresses and amounts before signing. Those connected only to servers they trust, including their own, were not exposed.