Bitcoin light wallet Electrum disclosed on Oct. 24 a malicious server attack targeting transaction fee bumping and said it fixed the issue in version 4.8.3, under GitHub security advisory GHSA-6jp4-8v48-cc5v.
The advisory said users performing a routine fee increase could end up signing funds over to an attacker. Developers said the issue surfaced after users reported losing funds after signing a fee bump.
Two reports described different outcomes
Electrum said the two reports did not end the same way.
In one case, a user said that after broadcasting a payment, the transaction shown in wallet history was replaced. That user also said the original payment never entered the Bitcoin peer-to-peer network and was withheld by the server. In the other case, user Raju-K12 fee-bumped the substituted transaction and lost funds.
How the attack worked
According to the advisory, a malicious server could withhold a new transaction broadcast by the client and insert a conflicting transaction into the wallet history, replacing the original output with an attacker address.
The substituted transaction carried invalid signatures at that stage, but the light client did not verify those signatures before displaying unconfirmed transactions. Once the user manually increased the fee through replace-by-fee, or RBF, and signed it, the attacker could receive the funds.
Both users said the attacker address shared the same last four characters as the legitimate recipient address.
What was not disclosed
The advisory did not disclose the amount stolen, transaction identifiers, or the attacker address.
Patch scope and limits
Electrum linked the fix to commit 90fe308. Before writing mempool transactions into local history, the wallet now checks signatures for inputs that belong to the wallet itself.
The advisory also said the patch does not cover inputs from addresses outside the wallet and does not perform full consensus validation.
Guidance and timeline
Electrum advised users who have not upgraded to verify output addresses and amounts every time they sign a transaction. Clients connected to their own server or a trusted server are not affected by this attack.
The timeline in the advisory shows an initial private disclosure on Oct. 11, a report of fee-bump-related fund loss on Oct. 18, a tagged fix on Oct. 23, and binary release plus public disclosure on Oct. 24.