Electrum crypto wallet flaw turned payment speed-ups into a theft trap
A fake pending payment could become a real transfer to an attacker when an Electrum user approved a higher fee.
Electrum has patched a crypto wallet flaw that let malicious servers trick users into sending Bitcoin to attackers. Developers disclosed the issue on October 24 after receiving two user reports, including one involving lost funds.
The trap targeted a routine action: raising a payment’s fee to help it go through faster. Versions before 4.8.3 are affected, and developers have urged users to upgrade. The disclosed attack required users to approve an altered payment.
A slow payment concealed a different destination
Electrum uses outside servers to retrieve payment information and send transactions to the Bitcoin network.
According to the developers’ advisory, a dishonest server could hold a legitimate payment, but it will show a fake one in the wallet’s history. The replacement then directed funds to a different address, which is the attacker’s address.
That fake payment could not spend the Bitcoin by itself. The danger emerged when a user tried to speed it up.
That fake payment could not spend the Bitcoin by itself, but the danger came when a user tried to speed the payment up.
The advisory noted that in both reported cases, the attacker’s address shared its last four characters with the intended recipient’s address. Looking at it at the ending absent-mindedly, one could therefore miss the fact that there have been some changes.
One reported loss, with the amount undisclosed
Developers received the first private report on October 11. A second user reported losing funds after increasing a payment’s fee on October 18.
The advisory says malicious servers were already carrying out the attack. It does not tell how much Bitcoin was stolen or the total number of affected users.
The documented method relied on deceiving users into approving a payment. It did not show that the attackers had stolen their private keys or broken Bitcoin’s security.
The update blocks the substitution
Electrum 4.8.3 adds checks on pending payments spending the wallet’s coins before displaying them in its history.
Developers also advise taking note of destination addresses and amounts before approving any transaction, including a fee increase. They say users connecting only to trusted servers, such as their own, are not affected by this particular attack.
Final Summary
- Electrum patched a flaw that could turn a fee increase into an attacker-directed Bitcoin payment.
- Developers reported two cases, including one loss, and urged users to upgrade to 4.8.3.
