Electrum Wallet Flaw Allowed Servers To Trick Users Into Paying Hackers

Electrum, one of Bitcoin’s oldest software wallets, published a security advisory on Saturday describing a weakness that attackers were already abusing. TL;DR A bug in the Electrum bitcoin wallet let malicious servers slip fake pending payments into users’ transaction history. Users who tried to speed up a stuck payment with Replace-by-Fee could end up signing coins over to the attacker. At least one user lost funds. Electrum released version 4.8.3 on October 24, and the amount stolen remains undisclosed. Users connected only to servers they trust, including their own, were not exposed. The Wallet Allowed Fake Pending Payments The developers had received two reports during October. One came from a user who lost money after approving what looked like an ordinary fee increase.

BeCrypto News shows a short excerpt and links to the publisher. The full report belongs to Bitcoinist.