Rogue Electrum Servers Swapped Payments for Fakes, Users Signed Them

Electrum pushed out version 4.8.3 on October 24 to kill a bug that let rogue servers trick wallets into signing payments to thieves. Maintainer SomberNight published advisory GHSA-6jp4-8v48-cc5v the same day and told users to upgrade. The flaw carries a high-severity rating.

Here's the con. You sign and broadcast a bitcoin payment. A malicious server quietly blocks it and feeds your wallet a different transaction that drains the funds to an attacker's address. Older Electrum never checked signatures on mempool transactions, so the fake showed up as pending while the real payment vanished from view. The server then gambles you'll do what any impatient sender does: bump the fee. Replace-By-Fee lets you rebroadcast an unconfirmed transaction at a higher fee, and that's the trap. Raise it on the fake, and your wallet stamps the attacker's version with a valid signature.

Victim dannydeezy walked through the whole thing in public. Their setup was a 2-of-3 legacy P2SH multisig with two Trezors, 31 inputs and one output, and they confirmed the output on both devices before broadcasting. The wallet then showed the full amount heading to an unknown address, briefly unconfirmed, before the entry flipped to Local. The fake mirrored the real transaction's inputs, version and locktime, with byte-identical scriptSigs across all 31 inputs. Every one of the 62 signatures validated against the genuine transaction and none against the copy.

The giveaway was cosmetic, which is exactly the point. Both addresses ended in the same four characters, GyQ3, because the attacker hunted down a lookalike that matched the tail of the real endpoint. Almost everything went to that twin address, with a crumb routed back to one of the wallet's own used addresses to keep things looking normal. Another user, Raju-K12, privately reported on October 18 that they bumped the fee on a fake and lost funds. Maintainers say some servers are running the attack live.

The fix, commit 90fe308, verifies signatures on wallet-owned is_mine inputs before a mempool transaction lands in local history. Electrum still can't check incoming unconfirmed transactions at all, because the light client has no full script interpreter. For anyone stuck on an older build, the workaround is to eyeball output addresses and amounts before signing anything, fee bumps included. Users who only connected to their own servers were never exposed.

This isn't Electrum's first scramble. In January 2018 it shut down a JSON RPC interface that had sat open for roughly two years after Google researcher Tavis Ormandy showed a website could spot the port and drain funds. ZachXBT has also flagged a similar address-poisoning scheme hitting Phantom wallet users, where spoofed addresses are engineered to survive a quick glance at the first and last characters.