Electrum discloses high-severity flaw: malicious server can trick users into RBF-paying attackers

AIFlow_ML · x · 2026-10-25

Bitcoin wallet Electrum disclosed a high-severity vulnerability (GHSA-6jp4-8v48-cc5v) affecting versions below 4.8.3, patched in 4.8.3.

• The attack: Light clients trust the connected server for mempool transactions. A malicious server can swallow a just-broadcast tx1 and insert a conflicting tx2 rerouting outputs to the attacker. Since signatures aren't verified by design, tx2 displays as unconfirmed while tx1 is hidden.
• Impact: If the user manually RBF fee-bumps tx2, they sign it with a higher fee — effectively paying the attacker. The advisory notes "some servers are performing this attack."
• Fix: From 4.8.3, the client verifies signatures of wallet.ismine inputs for mempool txs before adding them to local history.
• Advice: Upgrade immediately; otherwise verify output addresses and amounts before signing any transaction. Users running their own trusted servers are unaffected.

Original post →

More from Safety

• OpenAI cuts internet access for frontier model training after Hugging Face hack incident — emmanuelvivier · 2026-10-25
• Is decompiling with a coding agent hacking? X users clash over disclosure vs ownership — MickeySteamboat · 2026-10-25
• Agent builds 100%-reliable Node.js brotli exploit in 5 unsupervised hours — jcran · 2026-10-25
• Eric Jang: abliterated models show 'astounding' cyber capabilities — ericjang11 · 2026-10-25
• Gibberifier Stuns LLMs With Thousands of Invisible Unicode Characters, Now a Browser Extension — thegamebegins25 · 2026-10-25
• CivitAI tightening model moderation, creator urges artists to mirror uploads on Hugging Face — Far_Lifeguard_5027 · 2026-10-25

Safety channel →