Electrum, one of the oldest Bitcoin wallet apps, released version 4.8.3 on October 23 to fix a flaw its developers rate high severity. A rogue server could hide a payment you had just sent, show a forged copy that paid an attacker, and wait for you to speed it up. At least one user lost bitcoin that way. If you use Electrum, update it from electrum.org.

Key facts

  • Who: Electrum, a Bitcoin wallet app for computers and Android, and its users
  • What: A rogue server could replace a just-sent payment with a forged one and trick the user into signing it during a fee bump
  • When: Reported October 11 and 18; fixed in version 4.8.3, released October 23, 2026
  • Affected: Every Electrum version before 4.8.3, unless it only connects to a server you run yourself
  • Source: Electrum 4.8.3 release notes and security advisory GHSA-6jp4-8v48-cc5v

You send bitcoin from Electrum. It sits unconfirmed, so you click "Bump fee" to push it through. The wallet asks you to sign, and you do. Until this week, that click could have sent your coins to a thief.

How the trick worked

Electrum doesn't download the whole Bitcoin blockchain. It asks public servers, run by volunteers, what is happening with your wallet. Older versions trusted what those servers said about payments that hadn't confirmed yet, without checking the signatures.

So a rogue server could hold back the payment you had just sent and show you a forged one instead, paying the attacker's address. Developers say the fake addresses were made to end in the same four characters as the real one. In one case the forged payment showed a zero fee, which looked stuck and invited a fee bump. Bumping a fee means signing a replacement payment. Sign the replacement for the forged one, and the money goes to the attacker for real.

Electrum's notes for version 4.8.3 list it as high severity: "Malicious server can replace a just-broadcast tx and try to trick user into RBF-ing it." Users reported odd payments on October 11 and October 18, and the second user lost funds, CoinCentral reported. The developers haven't said how many servers took part or how much was taken.

What to do

  • Update to 4.8.3. The new version checks the signatures before it shows an unconfirmed payment. Download it only from electrum.org, or your phone's app store for the Android app.
  • Ignore "update" pop-ups. In late 2018, attackers ran their own Electrum servers to push a fake update message that installed a thief's copy of the wallet, crypto.news reported. A real update comes from the website, not from a message inside the app.
  • Can't update yet? Before you sign anything, including a fee bump, read the whole address and the amount, not just the last few characters. That habit also beats address poisoning, which uses the same look-alike trick.

People who connect Electrum only to a server they run themselves weren't exposed, the advisory says. Hardware wallet users still sign on the device, so the screen on the device is the place to check the address.

Is my other wallet affected?

The advisory covers Electrum. Other light wallets that lean on outside servers work in a similar way, so if yours offers an update this week, install it from the official source. If a stranger messages you about a wallet "security update," it's a scam, whatever the brand. Our Scams hub has the common versions.

Electrum hasn't said how many servers were rogue. Until everyone updates, the one check that always works is the one you do yourself: the full address, on the screen you trust, before you sign.

Sources: Electrum 4.8.3 release notes (October 23, 2026), Electrum security advisory GHSA-6jp4-8v48-cc5v, The Defiant, CoinCentral, crypto.news.