GoKawiilElectrum patches wallet flaw letting malicious servers swap in fake Bitcoin payments
Electrum released version 4.8.3 on October 24 to fix a vulnerability that allowed a rogue server to intercept a user's unconfirmed transaction and replace it with a fake one directing funds to an attacker. Because Electrum relies on third-party servers and previously didn't verify signatures on incoming transaction data, users attempting to speed up a 'stuck' payment via replace-by-fee could unknowingly sign a replacement that paid the attacker instead. Developer SomberNight's advisory cites at least two real-world reports, including one confirmed loss of funds.