← The Polylog Crypto Intelligence Brief
Morning Edition · Monday, October 26, 2026Published at 1:45 AM EDT · New York
Electrum Patches Flaw That Let Malicious Servers Steal Bitcoin During Fee Bumps
Attackers were exploiting the bug before disclosure, with at least one confirmed theft, and older versions of the wallet remain exposed when they connect to a hostile server.
Electrum, one of Bitcoin's oldest software wallets, released version 4.8.3 on Oct. 24 to close a high-severity flaw that let a malicious server steal funds from users who tried to speed up a slow payment. The developers disclosed the bug on Saturday and said some servers were already exploiting it. CoinDesk reports that at least one person lost bitcoin before the patch shipped.
The attack used a weakness in how Electrum trusts its data sources. Electrum is a light client. It does not download the full blockchain. It asks third-party Electrum servers, which anyone can run, for the wallet's transaction history. Before the patch, the wallet accepted pending (unconfirmed) transactions from those servers without verifying their signatures. According to Startup Fortune and Bitcoin.com News, an attacker who controlled a server could intercept a user's payment before it reached the network. The attacker then placed a fake pending transaction in the wallet's history. When the user used Replace-by-Fee (RBF), the standard Bitcoin method for raising the fee on an unconfirmed payment, the wallet built the replacement from the fake transaction. The user signed what looked like a routine fee increase, and the signed transaction sent the funds to the attacker.
The root cause is an input-validation failure at a trust boundary: the wallet treated unauthenticated server data as true. Bitcoin's consensus rules were not affected, and the signed thefts are valid transactions that cannot be reversed. The developers received two reports in October, including one from a user who lost funds after approving the fee bump. No total loss figure, recovery, or attribution has been published. Users connected only to servers they trust, including their own, were not exposed. Version 4.8.3 verifies signatures on the relevant unconfirmed transactions, but earlier versions remain vulnerable when connected to a malicious server.
The incident illustrates a distinction between self-custody and self-verification. An Electrum user holds the private keys, but by default the wallet learns the state of the blockchain from servers run by strangers. The developers advise users to check payment addresses and amounts before signing, which means the user, not the software, has to catch fraud the wallet failed to block on its own. Several other long-standing defects have turned up in widely used open-source crypto code this autumn.
What this means
Part of a tracked trend
Unaudited Open-Source Crypto Code Surfaces at Scale
Coordinated volunteer and AI-assisted review keeps exposing large backlogs of undiscovered defects in the open-source libraries that wallets, nodes and protocols depend on, so disclosure waves — not novel attacker research — become a recurring driver of emergency patches and incident risk across the ecosystem.
Townsquare
Start a discussion in Townsquare.
More from this edition
- Flash-Loan Governance Takeover Drains About $4.85 Million From X100 on Ethereum
- Initia Exploit Minted Unbacked Tokens and Emptied Its USDC Bridge Reserve to $63
- CoinDCX Admits $15.99 Million USDT Loss From Retired Wallets After Chief Executive Called Reports a False Alarm
- Bitget Hacker Resumes Laundering as October's Security Roundup Adds Ledger Implants and Balancer's Wind-Down
- A Live Ethereum Rollup Drops Elliptic-Curve Signatures for Hash Chains as Post-Quantum Designs Move Toward Production
- Lido Opens Permissionless Ethereum Validators of Up to 2,048 ETH Behind a 32 ETH Operator Bond
- Miden Launches a Private-Finance Stack Built on a Confidential Circle Dollar as Privacy Layer 2s Court Institutions
Comments
1Oct 26, 5:45 AM
Since the exploit depends on a hostile server, users who cannot upgrade immediately can reduce exposure by connecting only to an Electrum server they operate or trust.