Electrum Releases Version 4.8.3 to Fix Critical Vulnerability, Preventing Malicious Servers from Tampering with Unconfirmed Transactions

Odaily: Bitcoin software wallet Electrum released version 4.8.3 on October 24, fixing a critical vulnerability. Malicious servers could exploit this vulnerability to tamper with unconfirmed transactions and redirect user funds to attacker addresses; the vulnerability affects all versions prior to 4.8.3.

Attackers could intercept payments broadcast by users through compromised servers and inject fake conflicting transactions displaying zero fees. If users increase the fee on a transaction that appears stuck, the newly signed and broadcast transaction could send funds to the attacker's address. At least one user reported losing funds as a result on October 18.

This patch verifies the signatures of the wallet's own inputs before adding unconfirmed transactions to the local record; transactions from external senders whose inputs do not belong to the user's wallet are still not subject to signature verification. Electrum developer SomberNight stated that closing this gap will require additional work. (Decrypt)