Quick answer: Electrum 4.8.3, released on Oct. 24, 2026, fixes a high-severity flaw that some malicious servers exploited in the wild. A rogue server could hide a user’s real Bitcoin payment and show a fake one paying an attacker. If the user then bumped its fee, the wallet signed a valid payment to the attacker, per Electrum’s GitHub advisory.
Electrum 4.8.3 is out, and Bitcoin users who run the popular desktop wallet should install it now. On Oct. 24, 2026, Electrum developer SomberNight published a GitHub security advisory warning that “some servers are performing this attack in the wild,” and that at least one user lost money.
The flaw is rated high severity. It did not leak seed phrases or private keys. Instead, it tricked users into signing a real payment to an attacker while they thought they were only raising a fee.
How did the Electrum fee-bump attack work?
Electrum is a light wallet. It does not download the whole blockchain; it asks an Electrum server about your transactions. Mined transactions are checked against block headers, but unconfirmed ones in the mempool are taken on the server’s word. That trust is documented in Electrum’s FAQ.
According to the advisory, an attacker running a server could:
- Swallow the payment. When the user broadcast a transaction, the server held it back from the Bitcoin network.
- Show a fake. The server pushed a conflicting transaction into the wallet history that spent the same coins but paid the attacker. Its signatures were invalid, but the wallet did not check them.
- Wait for a fee bump. If the user used replace-by-fee (RBF) to speed up the “stuck” fake, Electrum signed a new, fully valid version of it, paying the attacker.
Two details made the trick hard to spot. Both victims said the attacker’s address had been ground to match the last four characters of the real one. In one case the fake carried a zero fee, which seemed designed to invite a bump.
Did anyone lose Bitcoin?
Yes. The advisory lists two private reports. The first, from user dannydeezy on Oct. 11, came from a 2-of-3 multisig wallet with two Trezor devices. The history suddenly showed the full amount going to an unknown address, and the real payment never reached the mempool. No money moved in that case.
The second, from user Raju-K12 on Oct. 18, did end in a loss: that user bumped the fee on the fake transaction. Electrum has not said how much was stolen, and no CVE number has been assigned.
What does Electrum 4.8.3 change?
The fix, in commit 90fe308, makes the wallet verify signatures on unconfirmed transactions that spend coins it owns before adding them to its history. As a result, a forged replacement like this one is now rejected.
The timeline was quick. The fix was tagged on Oct. 23, and binaries plus the public disclosure followed on Oct. 24, per the advisory. The 4.8.3 release notes list it as the release’s only high-severity issue, alongside many smaller fixes.
There is a limit, though. Electrum still does not validate incoming unconfirmed payments, because the client “lacks a full consensus engine,” the developers wrote. So an unconfirmed deposit shown in your wallet is still only the server’s claim until it is mined.
Who is at risk, and what should you do?
Anyone on a version older than 4.8.3 who connects to public servers is exposed. Users who connect only to a server they run or trust are not affected, the advisory says. Here is the safe checklist:
- Upgrade to Electrum 4.8.3 from the official electrum.org site and verify the GPG signature of the download.
- Check the full address and amount before you sign anything, including fee bumps. Do not rely on the last few characters.
- Do not bump a payment whose address changed. Switch to another server and look the transaction up on a block explorer first.
- Ignore “urgent update” links in DMs or ads. Fake wallet downloads often follow real alerts, as the Coldcard phishing case showed.
What does this mean for Bitcoin wallet security?
The bug hit how wallets trust servers, not Bitcoin itself. It is the latest in a busy month for wallet security, after the Keystone data breach and new Bitcoin Core security rules for a wave of AI-found bugs.
Prices barely reacted. At 09:55 UTC on Oct. 25, Bitcoin traded near $80,220, down 0.4% in 24 hours, per CoinGecko data; see our live Bitcoin price page.
Electrum 4.8.3 FAQ
Is Electrum safe to use after the 4.8.3 update?
Yes, for this attack. Version 4.8.3, released on Oct. 24, 2026, rejects fake unconfirmed transactions that spend your own coins. Keep checking full addresses before signing, since incoming unconfirmed payments are still not validated.
Were seed phrases or private keys exposed?
No. The attack did not steal keys. It tricked users into signing a real payment to the attacker during a replace-by-fee bump, per Electrum’s advisory.
How do I know if my Electrum wallet was hit?
Look for a recent payment whose address or amount changed in your history, often with a near-zero fee. If you see one, do not bump it; check the real transaction on a block explorer from another server.
Am I safe if I run my own Electrum server?
Yes. Electrum says clients that connect only to servers they trust, such as their own, are not affected by this flaw.
Not financial advice. Crypto assets are volatile; do your own research (DYOR) before you trade or move funds.
