TL;DR
Get your next haul delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
Electrum disclosed a vulnerability that reportedly let malicious servers manipulate pending transactions and trick some users into approving payments to an attacker. Developers issued an update that adds signature checks for certain unconfirmed transactions, but older versions remain vulnerable when connected to malicious servers.
Electrum has disclosed a vulnerability in its bitcoin wallet that reportedly let malicious servers alter how pending payments appeared, potentially prompting users to approve transactions sending funds to attackers. The wallet’s developers have issued an update adding checks for certain unconfirmed transactions; older versions remain vulnerable when connected to malicious servers, according to reporting by CoinDesk and PYMNTS.
CoinDesk reported that Electrum disclosed the issue over the weekend and said some servers had begun exploiting it. Developers had received two reports this month, including one from a user who lost money after approving what appeared to be a routine transaction-fee increase. The reports indicate the flaw could have financial consequences, but the supplied reporting does not establish the total number of affected users or the overall amount lost.
Electrum relies on outside servers to retrieve transaction histories and broadcast payments rather than requiring users to run a full bitcoin node. Before the fix, the wallet trusted those servers’ information about pending transactions without verifying their signatures. A server under an attacker’s control could reportedly intercept a payment before it reached the bitcoin network and substitute a phony transaction in the wallet’s history. The wallet could then display that transaction as pending.
The reported trap involved Replace-by-Fee, a bitcoin feature that allows an unconfirmed transaction to be replaced with one carrying a higher fee. A user attempting to speed up the phony pending transaction could approve a replacement that instead sent the funds to an attacker. Electrum’s update adds signature checks for unconfirmed transactions using coins from the customer’s own wallet. Developers recommend upgrading and checking the receiving address and amount before signing.
How Fee Bumps Could Redirect Funds
The vulnerability matters because the risky action could look like an ordinary attempt to make a delayed bitcoin payment confirm faster. Rather than exploiting bitcoin’s cryptography, the reported method took advantage of the wallet’s reliance on server-supplied transaction information and the user’s approval of a replacement transaction. That distinction matters to users: a payment shown as pending in a wallet is not, by itself, proof that its displayed details are trustworthy.
For people using Electrum, the immediate practical concern is whether they are running an affected version and whether they connect to a malicious server. The available reporting does not provide a complete list of compromised servers or quantify losses, so the extent of exposure is unknown. Still, the reported user loss and the developers’ update make this a direct wallet-security issue, not simply a theoretical weakness.
Products Worth Considering
Hyperice Normatec Elite Wireless Compression Boots Recovery – Standard Size
Hyperice Normatec 3 Leg Compression Boots – Standard Size
Therabody SmartGoggles 2nd Gen Heated Eye and Temple Massager
As an affiliate, we earn on qualifying purchases.
Electrum’s Server-Based Transaction Checks
Electrum is a bitcoin software wallet that uses external servers to obtain transaction histories and relay payments. In the vulnerability described by CoinDesk, the wallet accepted information about unconfirmed transactions from those servers without verifying signatures. The flaw therefore involved how Electrum handled server-provided transaction data and user approvals, rather than a reported break in bitcoin’s underlying encryption.
The report places the disclosure amid other recent cryptocurrency security incidents. Earlier in October, hardware-wallet company Ledger said it was investigating a hack that siphoned away $90 million from its devices. PYMNTS also referenced a Coinkite hardware-wallet software flaw reported in the summer. Those cases are separate from Electrum’s issue: the provided material does not link them or establish a common attacker or cause.
“The developers said some servers had begun exploiting the vulnerability.”
— Electrum developers, as reported by CoinDesk
Scope of Exposure Remains Unknown
The available reports do not identify the servers involved, say how many users were affected, or give a total value for losses tied to this flaw. They describe two reports received by developers this month, including one user who lost money, but do not establish whether those reports account for all incidents. The supplied material also does not specify the update’s version number or give a date by which all users are expected to install it.
It is also unclear how many older installations remain in use or whether additional malicious servers are still operating. The report says earlier Electrum versions can remain vulnerable when connected to malicious servers; it does not say that every older installation has been attacked. Users’ exposure depends on details that have not been publicly established in the source material.
Update and Verify Each Payment
Electrum users should install the available update and, before approving a payment or fee increase, confirm that the displayed destination address and amount match their intent. That check is especially relevant when a wallet presents an unconfirmed transaction and offers to raise its fee. Users should not assume that a pending transaction’s displayed details are safe solely because they appear in the wallet history.
The next developments to watch are further information from Electrum about the affected versions and servers, and any additional reports clarifying the number of victims or losses. The source material does not announce a deadline, a complete incident count, or a separate remediation process beyond installing the update and verifying payment details before signing.
Key Questions
What did the Electrum vulnerability do?
According to CoinDesk’s report, a malicious server could alter how a pending transaction appeared in Electrum. A user trying to increase its fee could then approve a replacement payment directed to an attacker.
Did the bug break bitcoin’s encryption?
The reports describe a weakness in Electrum’s handling of information supplied by outside servers, not a break in bitcoin’s encryption or a reversal of confirmed blockchain transactions.
Has Electrum released a fix?
Yes. The reported update adds signature checks for unconfirmed transactions that use coins from the customer’s own wallet. Earlier versions are still described as vulnerable when connected to malicious servers.
How many users lost money?
The reports cite two reports received by developers this month and one user who lost money. They do not establish the total number of affected users or total losses.
What should Electrum users do?
Install the update and check the receiving address and amount before signing a payment, including a transaction offered as a fee increase.
Source: rss
