01
A critical bug in the Electrum Bitcoin wallet let malicious servers trick users into signing away their own funds.
02
The flaw lived in how Electrum's light wallet trusted unconfirmed transaction data sent by the server it connects to.
03
A rogue server could hide a user's real payment and show a fake one that paid an attacker instead.
04
The fake transaction carried zero fee, nudging the user to bump the fee and unknowingly sign the theft.
05
Attackers ground their address to share the last four characters of the real one, making the swap easy to miss.
06
Electrum received the first private report on October 11, 2026, and a confirmed monetary loss on October 18.
07
Version 4.8.3, released October 24, 2026, now checks signatures before trusting any unconfirmed transaction.
08
If you run Electrum, update to 4.8.3 now and always double-check addresses before approving any fee bump.