Electrum Patches Flaw That Let Malicious Servers Redirect Bitcoin Fee Bumps to Attackers

Electrum, one of the oldest light Bitcoin wallets, released version 4.8.3 on October 24 to close a flaw that malicious servers were already exploiting. Older versions accepted a server's report of a pending transaction without checking its signature, according to TFTC. A hostile server could place a fake unconfirmed transaction in a user's history. When the user then raised the fee to speed up the payment (replace-by-fee, or RBF), the wallet built the new transaction from the fake one, and the user ended up signing a payment to an address the attacker controlled. Developers received two reports in October and confirmed at least one loss, Bitcoinist reports. Users who connect only to their own Electrum server were not exposed. The root cause is trust placed in an unauthenticated server. Electrum's design lets anyone run a public server, and that openness made this attack possible.

A smaller Ethereum incident had a similar cause. On October 19 an attacker drained about $59,800, by SlowMist's count, from smart wallets built on the Argent design. The deployment was not Argent's official wallet, according to a post-mortem. The relayed-signature path checked for a valid owner or guardian signature but never marked a nonce (a one-time counter) as used. Its deadline check also overflowed, so years-old signatures still passed. The attacker replayed the same signature 19 times in one transaction and 9 times in a second. Each replay forced victim wallets to buy MARK in a thin Uniswap V2 pool while the attacker traded against them. DeFiHackLabs added a reproduction to its archive, which then counted 901 incidents.

On Solana, Solflare said a security incident at an unnamed staking provider affected the keys for its validator, which has stopped producing rewards. Validator trackers show about 1.56 million SOL delegated to the node, The Defiant reports. Delegated SOL stays in stake accounts that only their owners' keys control, so whoever holds the compromised validator keys cannot move the delegated funds. Solflare says it will move users to a new validator through an app update and pay compensation to those who move.

Physical coercion also continues. A 27-year-old St. Louis man pleaded guilty in Hartford to conspiracy to commit Hobbs Act robbery. The charge covers a failed August 2024 plot to steal bitcoin from a Connecticut family.