Most $Bitcoin thefts need your seed phrase. This one did not. A flaw in Electrum, one of the oldest Bitcoin wallets, let a malicious server replace a pending payment with a fake one and then
Most $Bitcoin thefts need your seed phrase. This one did not. A flaw in Electrum, one of the oldest Bitcoin wallets, let a malicious server replace a pending payment with a fake one and then wait for you to do something completely routine: speed it up. The moment you approved the higher fee, you signed the attacker’s transaction instead of your own. At least one user lost funds before the fix landed on October 24. Here is what happened and why it matters even if you have never used Electrum.
Light wallets like Electrum do not download the whole blockchain. They ask external servers for your transaction history and for broadcasting payments. Confirmed transactions are checked against the chain, but pending ones were simply taken on trust from the main server the wallet happened to be connected to.
That gap was the opening. An attacker running one of those servers could intercept an outgoing payment before it reached the network, then feed the wallet a counterfeit version. The counterfeit spent your coins to an address the attacker controlled, in at least one case with the same last four characters as the real recipient, and it carried a fee so low that it would never confirm. The wallet displayed it as a legitimate pending payment.
Then came the bait. A stuck transaction naturally pushes users toward Replace-by-Fee, the standard Bitcoin feature for bumping a slow payment. In Electrum, bumping the fee meant re-signing the transaction shown in the history. Since that transaction was the attacker’s, the signature was valid, the coins moved, and the theft looked like a normal fee increase.
Electrum disclosed the issue on October 24 and confirmed that some servers were actively exploiting it. The first report came on October 11 from a user running a two-of-three multisig setup with two hardware wallets, who spotted a foreign outgoing transaction in the history but did not lose funds. A second user was not so lucky. The developers have not disclosed the amount stolen or named the servers involved.
The largest crypto assets compared over 90 days, according to CoinMarketCap data
Users who connect only to their own server or to a server they trust were never exposed. Everyone else running a version below 4.8.3 remains vulnerable as long as the wallet can land on a rogue server.
Version 4.8.3 adds signature checks for unconfirmed transactions that spend coins from your own wallet. A server can no longer slip an invalid transaction into your history and have the wallet present it as real. Download the update only from electrum.org, never from an in-wallet pop-up or a link in a message. Electrum users were hit by exactly that kind of fake update prompt in 2019, when rogue servers drained more than $4.6 million.
The Fear and Greed Index places market sentiment between extreme fear and extreme greed
The lesson goes beyond one wallet. Any software that trusts a third party for unconfirmed data has the same weak spot, so a few habits are worth keeping:
Self-custody puts you in charge of security, and that includes the boring steps. A thirty-second address check is still the cheapest insurance in crypto. You can track the current Bitcoin price and the wider market on our prices page.
