Electrum servers trick wallet users into signing fake zero-fee payments

Electrum released version 4.8.3 on October 24 to fix a high-severity flaw in which malicious Electrum servers replaced users’ just-broadcast bitcoin payments with fake zero-fee transactions sending funds to lookalike addresses. Electrum is a light client that relies on servers for unconfirmed mempool transactions, and older versions did not verify signatures of those transactions. The fake transactions carried invalid signatures; if a victim raised the fee through Replace-By-Fee, the wallet could sign the attacker’s version with a valid signature. Maintainer SomberNight issued advisory GHSA-6jp4-8v48-cc5v the same day and asked users to upgrade. The fix checks signatures on wallet-owned inputs before adding mempool transactions to local history.