Electrum fixes Bitcoin theft flaw after rogue server attacks

Electrum, a popular Bitcoin wallet, released version 4.8.3 on October 24 to address a critical vulnerability that exposed users to theft when interacting with rogue servers. The update resolves a flaw in older versions that allowed attackers to steal funds when users attempted to increase transaction fees using the Replace-by-Fee (RBF) feature. The vulnerability centered on Electrum’s reliance on external servers to provide unconfirmed transaction data. Instead of operating as a fully validating Bitcoin node, Electrum acted as a lightweight client, depending on third-party servers for mempool information without verifying transaction signatures for wallet-owned inputs. Attackers exploited this trust by operating malicious Electrum servers. When a user created a transaction, the rogue server intercepted the payment and prevented it from reaching the Bitcoin network.

BeCrypto News shows a short excerpt and links to the publisher. The full report belongs to CoinTurk News.