Electrum 4.8.3 patches a high-severity flaw that let malicious servers trick users into paying attackers in October 2026
Electrum patches a flaw used by malicious servers
On 24 October 2026 Electrum released version 4.8.3 and disclosed a high-severity flaw that let a malicious server swap a user's fresh payment for a fake one paying the attacker. The developers say some servers are using it in the wild and that one of two reporting users lost money.
Piece published Reviewed by CryptoGuardz Register Desk, editorial desk
Electrum, the desktop and Android bitcoin wallet, released version 4.8.3 on 24 October 2026 and disclosed a flaw it rates high severity. A malicious Electrum server could hide a payment the user had just sent and show a fake replacement paying the attacker. The developers say some servers are doing this in the wild, and one of the two users who reported it lost money after bumping the fee.
Every Electrum version below 4.8.3 is affected, according to the advisory. The amount stolen has not been disclosed. As of 29 October, electrum.org still lists 4.8.3 as the current release.
What the document says
The advisory, published on Electrum's GitHub repository, describes the attack in the developers' words:
when the client broadcasts a new tx1, a malicious server can swallow it, and update the client's history with a conflicting (invalid) tx2 that replaces the outputs with the attacker's output address.
The fake transaction carries invalid signatures, which the wallet did not check because of its light-client design. The wallet then showed the fake as unconfirmed and did not display the real payment. If the user used Replace-by-Fee to raise the fee on the fake, the wallet signed it with a higher fee, and so paid the attacker.
The advisory lists what the two reporters saw. The first noticed a different transaction in the history after sending, and said the real payment never reached the bitcoin network. The second bumped the fee and lost funds. Both said the attacker's address matched the last four characters of the real one. Based on the second report, the developers say the server built the fake with zero fee, "presumably in hope of the user bumping its fee".
The timeline in the advisory: private report on 11 October, report of a loss on 18 October, the fix tagged on 23 October, binaries and public disclosure on 24 October.
What it changes for users
Version 4.8.3 makes the wallet verify signatures on unconfirmed transactions that spend the wallet's own coins before adding them to its history. The fix is in commit 90fe308. The advisory says incoming transactions are still not validated this way.
New release: Electrum 4.8.3. This release fixes a critical security issue, so we urge all users to upgrade. A description of the vulnerability will be published later today. (note: Windows Defender may show a warning about ZXing.dll, ignore that, it is a false positive)
For users who have not upgraded, the developers give one workaround: before signing any transaction, including a fee bump, check that the output addresses and amounts are the ones expected. Users who connect only to a server they run or trust are not affected, the advisory says.
Electrum's own FAQ already set out this trust model. The client tries to keep connections to about 10 servers but picks one, arbitrarily, as the main server, which is trusted about unconfirmed transactions and broadcasts the user's payments.
Background
Other wallets can also use Electrum servers: the quick start guide for Sparrow lists a private Electrum server as one of its 3 ways to connect. The advisory covers the Electrum software only and does not say whether other wallets that talk to Electrum servers are exposed: not verified. The lookalike address trick is the same family as the address poisoning described in the Duelbits hack brief, and the self-custody safety checklist covers checking addresses before sending.
Quick answers
Which Electrum versions are affected?
All versions below 4.8.3, according to the advisory. Version 4.8.3 was tagged on 23 October 2026 and its binaries were released on 24 October.
How much bitcoin was stolen?
Not disclosed. The advisory says it received two user reports and that one user lost money, without giving an amount.
Am I safe if I never bump fees?
Not fully. The fake transaction still replaces the real one in the history, and the real payment may never reach the network. The developers' workaround is to check every output address and amount before signing.
Sources
- Electrum security advisory GHSA-6jp4-8v48-cc5v, Malicious server can replace a just-broadcast tx and try to trick user into RBF-ing it, published 24 October 2026, retrieved 29 October 2026
- Electrum RELEASE-NOTES, Release 4.8.3 (October 23, 2026), retrieved 29 October 2026
- Electrum fix commit 90fe308, retrieved 29 October 2026
- Electrum documentation, FAQ, Does Electrum trust servers?, retrieved 29 October 2026
- Electrum website, home page release listing, retrieved 29 October 2026
- Sparrow Wallet documentation, Quick Start Guide, retrieved 29 October 2026
- crypto.news, Electrum wallet fixes security flaw after hackers steal Bitcoin, 25 October 2026, retrieved 29 October 2026
About this piece
Compiled by the CryptoGuardz register team from the sources listed above. Research and drafting are AI-assisted and reviewed by a named editor before publication. Nothing here is a recommendation to gamble. If a figure or a reading is wrong, tell us and the correction is logged in public.