Electrum servers trick wallet users into signing fake zero-fee payments

Malicious Electrum servers replaced users’ just-broadcast bitcoin payments with fake zero-fee transactions paying lookalike addresses. Servers apparently bet victims would raise the fee and sign the fake. Electrum released version 4.8.3 on October 24 to address the high-severity flaw. Maintainer SomberNight released advisory GHSA-6jp4-8v48-cc5v the same day and requested users to upgrade. Forged address shared a GyQ3 ending with the legitimate destination Electrum is a light client. It doesn’t have a full bitcoin node and relies on its server for unconfirmed mempool transactions. Its own documentation explains how it works. Someone signs and sends tx1. A bad server stops it and sends a different tx2 to the wallet that sends the money to an attacker’s address. Tx2 has invalid signatures.

BeCrypto News shows a short excerpt and links to the publisher. The full report belongs to Cryptopolitan.