Bitcoin Fee Bumps Became an Attack Route – Patch Released

Electrum developer SomberNight disclosed on October 24 a high-severity flaw in the Bitcoin wallet that let a malicious server trick a user into signing a fraudulent payment through a fee bump; version 4.8.3 was released with a fix. Two users reported attacks, and one, identified as Raju-K12, lost an undisclosed amount on October 18 after raising the fee on a fake transaction. The attack exploited replace-by-fee, which replaces a pending payment with a higher-fee version and requires a new signature. The fix makes Electrum verify signatures on unconfirmed transactions spending the wallet’s own coins before adding them to history.