Electrum 4.8.3 Patches Actively Exploited Fee-Bump Wallet Flaw
By Node Zero
October 24, 2026
Electrum published a high-severity security advisory on October 24 and shipped patched binaries for 4.8.3 after confirming that malicious Electrum servers are actively abusing a Replace-by-Fee path in older clients. Advisory GHSA-6jp4-8v48-cc5v, posted by maintainer SomberNight, says versions before 4.8.3 can be tricked into signing a fee bump that pays an attacker if the wallet’s primary server swaps a just-broadcast payment for a conflicting fake in the unconfirmed history. Electrum says it received two private user reports — one notice-only case and one in which a user lost funds after bumping fees — and that some servers are already running the attack in the wild. Official 4.8.3 downloads are live on download.electrum.org/4.8.3.
The light-client trust model is the root surface. Electrum documents that the main server is trusted for mempool and unconfirmed history. In the disclosed pattern, when a client broadcasts a real payment (tx1), a malicious server can swallow that broadcast so it never reaches Bitcoin peer-to-peer gossip, then feed the wallet a conflicting fake (tx2) that rewrites outputs toward an attacker address. Because the client did not previously verify signatures on those mempool entries, the fake can carry invalid signatures and still appear as the only unconfirmed spend. If the user then manually Replace-by-Fee bumps what the wallet shows, the client signs the substituted transaction at a higher fee and pays the attacker. Both reported fakes ground the attacker address to match the last four characters of the legitimate destination, and one report described a near-zero-fee fake designed to invite a bump.
The fix in commit 90fe308, shipped in 4.8.3, verifies signatures on wallet.is_mine inputs for mempool transactions before those entries enter local history. Electrum notes the remaining scope limit: the client still does not fully validate incoming unconfirmed spends that are not paying from wallet-owned inputs, because a light client lacks a full consensus script engine and would otherwise need to recurse through unconfirmed parents to mined ancestors. Mined transactions already use SPV checks. Users who connect only to servers they operate or otherwise trust are outside the primary-server attack path described in the advisory. Until an upgrade lands, Electrum’s workaround is blunt: before signing any transaction — fee bump or not — verify every output address and amount match what you expect.
Timeline credits responsible disclosure. User dannydeezy privately reported on October 11 without the fee-bump vector fully mapped; user Raju-K12 reported privately on October 18 after losing money on a bump; 4.8.3 was git-tagged October 23; binaries and public disclosure followed October 24. Release notes also credit additional reporters tokenistq and Amadeus29 among the security-fix cohort. Hardware-wallet users are not exempt from the server-history trick: one incident report described a 2-of-3 legacy P2SH multisig with two Trezors where outputs were verified on-device before broadcast, then the desktop history flipped to an unknown lookalike address while the real signed transaction never reached the mempool. Desk takeaway: device confirmation of the first send does not protect a later fee-bump if the unconfirmed history the desktop shows has already been swapped.
Keep this chapter on Electrum’s client/server trust boundary — not a chain consensus bug and not a marketplace venue story. It sits next to, but separate from, Bitcoin Core’s LLM rediscovery disclosure (**11049**) and from today’s Ethereum governance drain on X100 Global (**11140**). Collectors who still broadcast Bitcoin payments through Electrum should treat 4.8.3 as the minimum live build, prefer servers they control when possible, and refuse any fee bump whose outputs do not match the original payment. Attribute all incident counts and attack details to Electrum’s advisory and release notes; final loss tallies beyond the two disclosed reports are not published.
Next protocol beat: Watch for Electrum follow-on advisories if more malicious servers are named, for package-manager and Android store mirrors to finish mirroring 4.8.3, and for any CVE assignment that links exchanges or custodians that still pin older Electrum builds in their tooling.
Bottom line: Electrum’s 4.8.3 release patches an actively exploited fee-bump path where a malicious server can swap unconfirmed history and trick users into signing attacker payouts — upgrade from any older build and verify outputs before every signature.
Disclaimer: This article is provided for informational and educational purposes only. It does not constitute financial, investment, legal, or trading advice. The NFT market is highly volatile, and past performance is not indicative of future results. Readers should conduct their own research and consult qualified professionals before making any decisions related to digital assets. The cover image for this article may have been created using artificial intelligence (AI).
