Electrum disclosed a wallet flaw on October 24 that could let a malicious server turn a user-approved fee increase into a payment to an attacker. Its advisory says the server could substitute an unconfirmed wallet-history entry before the user approved the replacement transaction. Developers reported two affected users, including one who lost money, but the disclosure gives no total loss figure.
Electrum says version 4.8.3 fixes the flaw and directs users to downloads on its official site. The update cannot reverse a transfer already confirmed to the wrong recipient, and users still need to check the destinations and amounts of each transaction they approve.
