Electrum Wallet Flaw Let Servers Trick Users Into Paying Hackers

How the Attack Worked

Electrum, one of Bitcoin’s oldest software wallets, issued a security advisory on Saturday. The advisory details a flaw that let malicious servers inject fake pending payments into users’ transaction history. Attackers were already exploiting this weakness in the wild.

The vulnerability centered on how Electrum handled Replace-by-Fee transactions. When a user attempted to speed up a stuck payment, the wallet would send a new transaction with a higher fee. A malicious server could intercept this request and inject a fake pending transaction into the user’s history. The fake entry made it look like a payment was already in progress, potentially confusing users into thinking their original transaction was still valid.

The exploit relied on server-side manipulation. Electrum servers act as intermediaries between the wallet and the Bitcoin network. A compromised or malicious server could alter the transaction data before it reached the user’s wallet interface. The user would see a pending payment that never actually existed on the blockchain. This created a window where attackers could redirect funds to their own addresses.

What Users Should Do Now

The advisory urged users to verify transactions directly on the blockchain using a block explorer. Users were advised to check the transaction ID and confirm the destination address before broadcasting. This extra step would expose any server-injected fake entries.

Security researchers noted that the flaw affected multiple versions of Electrum. Users running older builds were at higher risk. The advisory recommended updating to the latest version immediately. Users with pending transactions during the attack window should verify each one on a trusted block explorer.

The incident highlights a broader concern about trust in wallet-server interactions. As Bitcoin adoption grows, server-side vulnerabilities become a larger attack surface. Developers are now patching the flaw, but users must stay vigilant. The advisory also warned that some attackers had already drained funds from affected accounts. Victims should monitor their wallets for unauthorized transactions and report anomalies to the Electrum team.

Frequently Asked Questions

What is Replace-by-Fee and why was it targeted? Replace-by-Fee lets users replace a stuck transaction with a new one paying a higher fee. Attackers targeted this mechanism because it involves server interaction, creating an opportunity for injection.

How do I verify my transactions are legitimate? Check the transaction ID on a trusted block explorer. Confirm the destination address matches your intended recipient. If a transaction appears in your wallet but not on the blockchain, it may be a server-injected fake.

Which Electrum versions were affected? The advisory did not specify exact version numbers, but older builds were at higher risk. Users should update to the latest release and verify any pending transactions on a block explorer.