bitcoin ·
Bitcoin Wallet Fixes Critical Flaw That Redirected Funds to Attackers
A confirmed exploit let rogue servers replace Electrum’s pending transactions, tricking users into redirecting Bitcoin to attacker addresses.
Bitcoin wallet Electrum patched a high-severity vulnerability this weekend that allowed rogue servers to manipulate pending Bitcoin transactions and redirect funds to attacker-controlled addresses. The flaw affects all versions before 4.8.3, which is now available. At least one user has confirmed losing money to the exploit.
Electrum is one of the oldest Bitcoin software wallets around. The attack exploits the wallet’s trust model for unconfirmed transactions. When a user broadcasts a payment through a compromised server, the server can suppress the real transaction and inject a fake conflicting one—showing an attacker’s output address and zero fee, making the payment look stuck. Because Electrum doesn’t verify signatures on unconfirmed transactions from the server, the spoofed transaction appears in the wallet’s history as legitimate.
Reported by Decrypt.
