A security flaw in the Electrum Bitcoin wallet has allowed malicious servers to redirect payments when users tried to speed up transfers. Developers confirmed that at least one user lost funds before the project released a security update on October 24.
In its October 24 security advisory, Electrum said attackers had placed false pending payments in users’ wallet histories. The vulnerability affected versions released before 4.8.3.
How Rogue Servers Replaced Bitcoin Transactions
Electrum uses outside servers to access Bitcoin transaction records and send payments to the network. Unlike a full Bitcoin node, the wallet does not independently verify every part of an unconfirmed transaction. Attackers exploited that gap by operating servers that supplied false information.
When a user sent Bitcoin, a malicious server could block the original payment from reaching the network. It then displayed a different transaction in the wallet history. That transaction directed the same funds to an address controlled by the attacker, even though its signatures were invalid.
The attack required an additional action from the user to complete the theft. Bitcoin’s Replace-by-Fee feature allows senders to increase fees on pending payments. If someone selected that feature for the substituted transaction, Electrum could sign a new, valid payment carrying the attacker’s destination address.
In one reported attack, the false payment had no transaction fee. The attackers used receiving addresses that matched the final four characters of the intended addresses, making them harder to distinguish when users checked only part of the address.
Electrum Receives Two Reports, Including One Theft
The first private report reached developers on October 11. It involved a wallet that required two signatures from three possible signers and used two Trezor hardware devices. The user checked the original payment on both devices before sending it.
However, the wallet later showed an outgoing payment to an unfamiliar address. The initial transaction had not reached the wider Bitcoin network. The user did not report losing any Bitcoin in that incident.
A second report arrived on October 18. That user had increased the fee on a substituted payment and lost funds. Electrum did not disclose the amount stolen or identify the servers behind either incident.
The developers confirmed that “some servers are performing this attack in the wild.” Their public disclosure did not establish how many servers took part or how many other users encountered the problem.
Electrum 4.8.3 Adds Checks for Outgoing Payments
Developers prepared the fix on October 23 and released Electrum 4.8.3 for download on October 24. The update checks signatures on unconfirmed transactions that spend funds from addresses belonging to the user’s wallet before recording those payments in its history.
The change prevents the specific false outgoing transactions described in the advisory from passing those checks. However, Electrum said the new verification does not extend to every incoming unconfirmed payment.
The project urged users to install the latest version and check complete receiving addresses and payment amounts before signing transactions, including fee increases. It said users who connected only to servers they trusted, such as their own servers, were not exposed to this attack.
Electrum lists version 4.8.3 on its official website and warns users against downloading wallet software from other sources. The site provides signed installation files for several operating systems.
Also Read: Bitcoin Slips Near USD 80,000 as Ether Falls to USD 2,370
Disclaimer : Crypto News India does not recommend that any cryptocurrency should be bought, sold, or held by you. Do conduct your own due diligence and consult your financial advisor before making any investment decisions.
