Electrum Fee-Bump Flaw: How a Rogue Server Turned "Speed Up" Into Theft
Electrum, one of Bitcoin's longest-running lightweight wallets, released version 4.8.3 on 24 October 2026 to close a high-severity vulnerability that was already being exploited. Developers confirmed at least one case in which a user lost funds.
What happened
The flaw affected fee bumping, the routine step of raising the fee on an unconfirmed transaction to get it confirmed faster. A malicious Electrum server could substitute the pending transaction with a fraudulent one. The user believed they were approving a simple fee increase, but in fact signed a payment to the attacker.
According to the Electrum team, all releases before 4.8.3 are affected.
Why it matters
Lightweight wallets like Electrum rely on external servers for blockchain data instead of running a full node. This incident shows the risk of that trust: a server does not need your keys to steal funds if it can manipulate what your wallet asks you to sign.
What users should do
- Update to Electrum 4.8.3 immediately, downloaded only from the official website.
- Avoid fee bumps on older versions until you have updated.
- Check the recipient address and amount carefully before signing, especially on a hardware wallet screen.
- Consider connecting Electrum to your own server or full node.
Sources
