Bitcoin Wallet Fixes Critical Flaw That Redirected Funds to Attackers

Electrum released version 4.8.3 to address a vulnerability that let malicious servers display fabricated unconfirmed transactions and redirect fee-bumped payments. The patch verifies signatures for wallet-owned inputs, but the article says incoming transactions from external senders remain unverified.

• Electrum 4.8.3, released October 24, fixes a flaw affecting earlier versions that allowed rogue servers to inject fake pending transactions directing payments to attackers.· 2 sources
• The article reports two user accounts: one suspicious server was flagged October 11 without a loss, and another user reported losing funds after fee-bumping a manipulated transaction on October 18.· 2 sources
• The patch checks signatures on wallet-owned inputs; the article says external incoming transactions still lack that verification and advises users to check addresses and amounts before signing if they cannot update.· 2 sources