Electrum released version 4.8.3 to fix a high-severity flaw that let malicious servers substitute Bitcoin transactions in earlier versions. Electrum confirmed a report of a user losing funds after approving a fee increase. The attack relied on older versions accepting some unconfirmed transactions without checking their signatures; a user who tried to raise a payment’s fee could instead sign a substituted payment to an attacker.
The update rejects such transactions if their signatures are invalid. Users connecting exclusively to trusted, self-hosted Electrum servers are not exposed to this particular server-based attack. Electrum urged other users to upgrade from electrum.org, verify the download’s cryptographic signatures, and check destination addresses and amounts before signing, including during fee changes.
