Hackers exploited a vulnerability in the Electrum wallet to steal Bitcoins
The developers of the Electrum crypto wallet have released an urgent update, version 4.8.3, to patch a vulnerability that attackers exploited to steal assets. The hackers replaced legitimate payments with fraudulent transactions, which wallet owners could inadvertently authorize while attempting to increase transaction fees.
Electrum is a Bitcoin wallet that connects to external servers to retrieve transaction history. It uses Simple Payment Verification (SPV) to validate transactions; however, the wallet relied on its primary server to display pending transactions.
Attackers intercepted transactions via malicious servers before the information reached the Bitcoin network. By suppressing the display of a legitimate transaction, the criminals could replace it, substituting the intended recipient's address with their own. Although the fraudulent transactions contained invalid signatures, vulnerable versions of Electrum failed to verify these signatures before displaying the transactions in the user's history.
The risk arose when users attempted to increase a transaction fee using the "Replace-by-Fee" (RBF) feature, which allows an unconfirmed payment to be replaced by another with a higher fee. By confirming the fee adjustment, users could end up signing a valid transaction that sent funds to the attacker.
The developers have confirmed two instances of crypto-asset theft. On October 11, a wallet user operating under the pseudonym "dannydeezy" reported that a transaction displayed in their Electrum history did not match the payment they had originally initiated. Another anonymous user, Raju-K12, notified the developers on October 18 that they had lost funds while attempting to increase a transaction fee. In this instance, the fraudulent transaction had a zero-value fee—a tactic the Electrum team believes was intended to goad the victim into initiating a fee increase themselves.
The vulnerability affected all versions of Electrum prior to 4.8.3. The developers did not disclose the total amount of funds stolen, the number of servers involved in the attack, or the number of victims. The Electrum team released a fix in version 4.8.3 on October 23, with downloadable binaries becoming available on October 24. The developers introduced signature verification for unconfirmed transactions, though they clarified that this update does not transform Electrum into a full Bitcoin node. Consequently, incoming unconfirmed transactions remain outside the scope of these new signature checks, while confirmed payments continue to undergo existing verification procedures.
Users running earlier versions of the wallet are advised to download the update from the official Electrum website. Those unable to update immediately should carefully verify the full recipient addresses and transaction amounts before signing any transactions—including those involving fee adjustments. Users who connect exclusively to trusted servers—or to their own private server—are not susceptible to this attack.
Separately, researchers from Symantec Threat Hunter recently identified a new version of the "Aoki" (Aokigahara) info-stealer—malware designed to exfiltrate AI assistant session files, browser cookies, and cryptocurrency wallet data. Hackers leverage stolen API keys to gain unauthorized access to associated repositories and cloud services.