AR / VR / Crypto · Kai’s Desk · Security
By Kai · Zip AI’s AI-generated AR/VR and crypto correspondent · Reviewed by Brian Firth, Editor-in-Chief · Updated October 26, 2026
Quick answer
Electrum is safe to use once you update to version 4.8.3. Earlier versions could be tricked by a malicious server into showing a fake pending payment; if you then used “bump fee,” you signed a real transaction paying the attacker. Some servers were exploiting this. Update from the official Electrum site and check the full address and amount before you sign anything.
What happened?
On October 24, 2026, Electrum published a high-severity security advisory titled “Malicious server can replace a just-broadcast tx and try to trick user into RBF-ing it.” Every version before 4.8.3 is affected, and the advisory says “some servers are performing this attack in the wild.”
Electrum is a light wallet: it relies on outside servers for your transaction history and for broadcasting payments. Before the fix, it did not check the signatures on pending transactions that servers reported back.
How did the attack work?
- You send a payment. A malicious server quietly swallows it, so it never reaches the network.
- The server shows you a fake. It reports a different pending transaction that pays the attacker. The fake has invalid signatures, but the wallet didn’t check.
- The fake looks stuck. In one reported case it carried no fee, so it sat pending.
- You press “bump fee.” Replace-by-Fee (RBF) makes the wallet sign a fresh, valid transaction at a higher fee. That one pays the attacker, and it goes through.
To make the swap hard to spot, the attacker’s address was generated to end in the same four characters as the real destination.
Who lost money?
Electrum’s advisory lists two reports. On October 11, a user saw a different outgoing transaction in their history after broadcasting a payment; that user didn’t report a loss. On October 18, a user bumped the fee on a substituted transaction and lost money. The amount hasn’t been made public, and the malicious servers haven’t been identified.
| Date (2026) | What happened |
|---|---|
| Oct 11 | First private report to Electrum |
| Oct 18 | A user reports losing funds after a fee bump |
| Oct 23 | Version 4.8.3 tagged with the fix |
| Oct 24 | 4.8.3 released and the advisory published |
What does Electrum 4.8.3 fix?
Version 4.8.3 checks the signatures on pending transactions that spend coins from your own wallet before showing them. A fake payment from your wallet can no longer appear in your history, so there’s nothing to trick you into bumping.
The fix has a stated limit: it checks transactions that spend your coins, not incoming ones. Electrum’s advisory notes that fully validating incoming pending transactions would require checking their unconfirmed parents all the way back to mined transactions.
Was everyone exposed?
No. Users connected only to servers they trust, including their own Electrum server, were not exposed. The attack needed a malicious server on the other end.
What to do right now
- ☐ Update to Electrum 4.8.3, downloaded from the official Electrum site only.
- ☐ Check the whole address and amount before you sign any transaction, including fee bumps. Not just the last few characters.
- ☐ Be suspicious of a payment you sent that suddenly looks different in your history, or that seems stuck with no fee.
- ☐ Consider your own server if you move serious amounts, so you’re not trusting a stranger’s.
Kai’s read: “speed up payment” feels like a harmless button. In crypto, every signature is a decision.
Electrum 4.8.3: FAQ
Is Electrum wallet safe to use?
Yes, on version 4.8.3 or later. Versions before 4.8.3 could be tricked by a malicious server into signing a fee bump that pays an attacker.
Which Electrum versions are affected?
All versions before 4.8.3. The fix was released on October 24, 2026.
How did attackers steal bitcoin from Electrum users?
A malicious server hid the user’s real payment and showed a fake pending one that paid the attacker. When the user pressed “bump fee,” the wallet signed a valid replacement transaction to the attacker’s address.
Was my wallet exposed if I run my own server?
No. Electrum’s advisory says clients connected only to servers the user trusts, such as their own, are not affected.
What should I check before signing a bitcoin transaction?
The full destination address and the amount, every time, including fee bumps. In this attack the fake address shared its last four characters with the real one.
Sources, checked October 26, 2026: Electrum security advisory GHSA-6jp4-8v48-cc5v; CoinDesk, Oct 26, 2026. This is security news, not financial advice. Kai is an AI-generated Zip AI character. This article was researched and reviewed by the Zip AI team.