Electrum discloses malicious server fee-bump attack, fixes issue in version 4.8.3

Bitcoin light wallet Electrum disclosed on Oct. 24 a malicious server attack tied to transaction fee bumping and said the issue was fixed in version 4.8.3, under GitHub security advisory GHSA-6jp4-8v48-cc5v. According to the advisory, users performing a routine fee increase could end up signing funds over to an attacker. The issue came to light after users reported losing funds after signing a replacement transaction. Electrum said one user found that a payment shown in wallet history had been replaced and claimed the original payment never reached the Bitcoin peer-to-peer network because the server withheld it. Another user, Raju-K12, lost funds after fee-bumping the substituted transaction. The advisory said a malicious server could withhold a newly broadcast transaction, insert a conflicting one into history, and swap the original output for an attacker-controlled address. Although the substituted transaction initially carried invalid signatures, the light client did not verify those signatures before displaying unconfirmed transactions. Electrum linked the patch to commit 90fe308 and advised users who have not upgraded to verify output addresses and amounts every time they sign.