Electrum Wallet Bug Let Attackers Trick Users Into Signing Over Bitcoin Payments

A flaw in the Electrum bitcoin wallet reportedly let cybercriminals swap in fake pending transactions and push users into signing valid payments to the attacker. For high-risk merchants and PSPs, the useful part is not the drama: this was a wallet-side trust failure around unconfirmed transactions and server-supplied data, not a break in bitcoin itself.

1. CoinDesk reported on Monday, October 26, that Electrum disclosed the vulnerability over the weekend after some servers began exploiting it. Developers said they had received two reports this month, including one from a user who lost money after approving what looked like a normal transaction fee increase.
2. Electrum does not run as a full bitcoin node. It uses outside servers to retrieve transaction histories and broadcast payments, and before the fix it trusted those servers to tell it about pending transactions without verifying their signatures. That left a hole an attacker controlling a server could use to intercept a payment before it reached the bitcoin network and replace it in the wallet history with a fake transaction.
3. The trap worked because the wallet displayed the fake payment as pending. If the user then chose bitcoin’s Replace-by-Fee (a feature that lets unconfirmed transactions be replaced with higher-fee versions), Electrum could end up approving a valid replacement that sent the funds to the attacker.
4. Electrum has issued an update that adds signature checks for unconfirmed transactions using coins from the customer’s own wallet, CoinDesk said. Older versions remain vulnerable when connected to malicious servers, and the developers are telling users to upgrade and to check receiving addresses and amounts before signing payments.
5. The report also places the incident next to other wallet attacks. Earlier this month, Ledger said it was investigating a hack that siphoned away $90 million from its devices, and this summer Coinkite disclosed a software flaw in similar cold-wallet devices. The common thread is that “cold” storage only helps if the software path around it does not hand attackers a shortcut.