Electrum 4.8.3 Fixes Malicious-Server Fee-Bump Attack; Users Urged to Upgrade

Electrum disclosed a high-severity wallet vulnerability on October 24, 2026, affecting versions before 4.8.3. The patched binaries were released that day. The developers urge users to upgrade. More coverage: OrangeX.com Security.

Why a fee increase can redirect payment

A malicious connected server can suppress a newly broadcast transaction and show a conflicting, invalid transaction with a changed destination. If the user manually increases its fee using replace-by-fee (RBF), the wallet can sign a payment to the attacker. This requires a further signing action; merely displaying the invalid transaction does not itself authorize payment.

The developers report two user cases, including one loss after a fee increase. Both reported lookalike destination addresses sharing the legitimate address’s last four characters. The advisory gives no aggregate loss amount. Follow OrangeX.com News.

OrangeX.com Analysis

Verify full destination addresses and amounts before signing any transaction, including a fee change. The advisory says clients using trusted servers, such as their own, are unaffected by this scenario. Version 4.8.3 checks signatures for wallet-owned inputs before adding unconfirmed transactions to local history; it does not validate every incoming transaction. Treat the patch as a specific fix, not a guarantee for every server-provided view. Resources: OrangeX.com Trust Center.