Electrum Urges 4.8.3 Update After Bitcoin Fee-Bump Attack
Electrum 4.8.3 fixes an exploited server flaw that can redirect Bitcoin payments when users raise fees. Developers report one user lost funds.
Key Notes
- Electrum urges users to upgrade to version 4.8.3 after a server-based wallet attack.
- Manually increasing the fee of a substituted transaction can authorize a payment to the attacker.
- Developers received two reports, including one involving a loss of funds.
Electrum has urged users to install version 4.8.3 after attackers exploited a Bitcoin-wallet flaw that can turn a routine fee increase into a payment to a criminal. Developers say one user reported losing funds.
The project’s October 24 announcement called the issue critical. Its technical advisory, GHSA-6jp4-8v48-cc5v, rates the vulnerability High and identifies versions before 4.8.3 as affected.
View Electrum’s release announcement
— Electrum (@ElectrumWallet) October 24, 2026
How a Fee Increase Can Redirect Bitcoin
Electrum is a lightweight Bitcoin wallet that has operated since 2011. Instead of downloading and validating the entire blockchain, it uses servers to retrieve information and broadcast payments. Its documentation explains that the main server is trusted for information about unconfirmed transactions.
A malicious server can withhold a newly submitted payment and show a conflicting transaction in the wallet’s history instead. The substitute directs funds to the attacker but initially carries invalid signatures, which older clients did not check before displaying it as unconfirmed.
The trap depends on the user manually increasing that transaction’s fee through Replace-by-Fee, or RBF. That action signs a replacement transaction, authorizing the attacker-directed payment. The attacker cannot simply rewrite an already signed Bitcoin payment into a valid transfer.
Developers received two user reports: one person noticed the substitution, while another lost money after raising the fee. They did not disclose the amount stolen.
What Version 4.8.3 Changes
The fix checks signatures on inputs spending the wallet’s own coins before accepting an unconfirmed transaction into its local history. It rejects invalid signatures at that stage, addressing the misleading history entry used in this attack.
This is a targeted check for the wallet’s own spending inputs, rather than full validation of every incoming unconfirmed transaction. Electrum remains a light client; the update does not turn it into a full Bitcoin node.
The advisory says users connected to servers they trust, including their own, are not affected by this attack. Electrum’s documentation also states that the client does not send its private keys to servers.
Download and Verify the Official Release
The release notes date version 4.8.3 to October 23. The advisory’s timeline distinguishes that software tag from the release of ready-to-install binaries and public disclosure on October 24.
Users should obtain the update from electrum.org and follow the project’s GPG verification instructions to check the download’s authenticity. Until they upgrade, developers advise checking destination addresses and amounts before signing any transaction, including a fee increase.
The release follows broader attention to security-update timing in Bitcoin software. CoinScreamer’s earlier report covered Bitcoin Core’s faster disclosure process for easily rediscovered bugs. Electrum’s separate advisory does not attribute this vulnerability to AI.
Disclaimer: CoinScreamer is an independent media brand owned and operated by NuvexMedia LLC, publishing news, research, and market insights on digital assets and related technologies. NuvexMedia LLC invests in and collaborates with companies across the digital asset, blockchain, and technology sectors. These relationships do not influence CoinScreamer’s editorial coverage, and the publication maintains full editorial independence to provide accurate, timely, and objective information. © 2025 NuvexMedia LLC. All rights reserved. This content is for informational purposes only and should not be considered legal, tax, investment, financial, or other professional advice.
