Electrum Patches Wallet Flaw Exploited Through Malicious Servers

Electrum is a lightweight Bitcoin wallet that connects to third-party servers for blockchain data instead of running a full node, a design dating to its 2011 launch. The wallet suffered a comparable server-side attack in 2018, when rogue servers pushed fake upgrade prompts to steal funds. The flaw disclosed October 24 with advisory GHSA-6jp4-8v48-cc5v exploits the same trust boundary: a malicious server intercepts a broadcast payment and dangles a fee-bump prompt to get it signed.

Every Electrum wallet running a version released before October 24 carries the exposure, so holders who have not upgraded to 4.8.3 can still have a routine fee bump redirect funds to an attacker's address. The fix requires a direct download from Electrum's own site rather than an in-wallet prompt, since that channel is exactly what malicious servers abused. Users must now check destination addresses and amounts on every signing screen, a manual step the advisory flags as the last line of defense.

Electrum's lightweight model trades full-node verification for convenience, letting anyone run a server that feeds transaction data to wallets that never check the chain themselves. That bargain means a self-custody wallet marketed as giving users full control of their keys can still be steered into signing away funds by an untrusted relay. The flaw being exploited in the wild, not just theoretical, sharpens a question SPV wallets have faced since Electrum's early years: convenience without a full node is not the same as security. (per unchainedcrypto.com)

Watch whether further loss reports surface beyond the single confirmed case disclosed alongside advisory GHSA-6jp4-8v48-cc5v, which would show the malicious servers stayed active after October 24. Electrum's developers have not said how many servers were compromised or named them, so the next test is whether the project publishes a blocklist or changes how servers are vetted. Adoption of version 4.8.3 over the coming weeks will reveal how many holders remain exposed. (per thedefiant.io)