ZetaPeakAttackers replaced legitimate transactions with fake ones, then waited for users to approve higher fees. At least one person lost bitcoin before developers patched the flaw.
Bitcoin wallet bug let rogue servers steal funds when users tried to speed up payments
Attackers replaced legitimate transactions with fake ones, then waited for users to approve higher fees. At least one person lost bitcoin before developers patched the flaw.
A flaw in Electrum allowed malicious servers to substitute fake pending Bitcoin transactions that users could unknowingly authorize when using Replace-by-Fee, with at least one theft confirmed. Electrum released version 4.8.3 on Oct. 24 to verify signatures on relevant unconfirmed transactions, but earlier versions remain vulnerable when connected to malicious servers. Users should upgrade Electrum and carefully verify payment addresses and amounts before signing transactions; those using only trusted servers, including their own, were not exposed.
A bitcoin wallet security flaw allowed malicious servers to trick users into signing payments to attackers when they tried to speed up transactions, with developers confirming at least one case in which money was stolen.
Electrum, one of Bitcoin's oldest software wallets, disclosed the vulnerability on Saturday, saying some servers were already exploiting it. The developers received two reports in October, including one from a user who lost funds after approving what appeared to be a routine transaction-fee increase.
The attack exploited how Electrum handles bitcoin payments that have not yet been confirmed by the network.
Unlike a full Bitcoin node, Electrum relies on outside servers to retrieve transaction histories and broadcast payments. Before the fix, the wallet trusted those servers to report pending transactions without checking whether their signatures were valid.
An attacker controlling one of those servers could intercept a payment before it reached the Bitcoin network and replace it in the wallet's history with a fake transaction. This replacement spent the user's coins to an address controlled by the attacker, using invalid signatures that Electrum failed to detect.
But the wallet then displayed the fake payment as pending, and the trap came when users tried to speed things up.
Bitcoin allows unconfirmed transactions to be replaced with versions carrying higher fees, a feature called Replace-by-Fee. If a user selected that option, Electrum could take the fraudulent transaction and sign a valid replacement, sending the coins to the attacker.
In one reported case, the malicious transaction carried no fee at all, making it appear stuck. Attackers also generated receiving addresses whose last four characters matched the legitimate destination, making the substitution harder to spot during a quick check.
The first report, submitted Oct. 11, involved a two-of-three multisignature wallet using two Trezor hardware devices. The user had checked the legitimate payment on both devices but later noticed a different outgoing transaction in the wallet's history (that user did not report losing funds).
A second user reported on Oct. 18 that they had raised the fee on a substituted transaction and lost money. Developers have not disclosed the amount stolen or identified the malicious servers.
In response, Electrum released version 4.8.3 on Oct. 24, adding signature checks for unconfirmed transactions spending coins from the user's own wallet. However, earlier versions remain vulnerable to the reported attack when connected to malicious servers.
The developers recommend upgrading and checking receiving addresses and amounts before signing payments. Users connected only to servers they trust, including their own, were not exposed to this attack.
The fix came six days after the first reported theft.
1Bitcoin slips under $80,000 as traders de-risk ahead of Fed meeting48 minutes ago 2Elon Musk issues a warning for 'AI neoclouds' as SpaceX borrows $40 billion for chips2 hours ago 3Latvia targets tokenization rules in 2027 with commercial property in focus14 hours ago 4UK banks face 10,000 complaints in 3 months over crypto restrictions16 hours ago 5Strategy, Strive face balancing act between bitcoin buying and preferred stock dividends1 day ago 6Block's new voice AI sounds eerily human, sparking awe and scam fears1 day ago 7Crypto under weekend pressure, bitcoin slides below $80,000 on U.S. Middle East evacuations1 day ago 8Why McDonalds, Microsoft and Google saying no to tokenized stocks isn't a dealbreaker1 day ago 9Argentina drops criminal probe into President Milei over crashed memecoin LIBRA1 day ago 10Wells Fargo, Cisco, Marvell among latest firms objecting to OKXICE's tokenized stock plan1 day ago
Beyond the Risk-Free Rate: Diversified Real World Yield in Productive Stablecoins
Beyond the Risk-Free Rate: Diversified Real World Yield in Productive Stablecoins
Diversified RWA stablecoins sustain 5-7% yield from real credit as crypto funding compresses to ~4%. GENIUS pushes yield off-chain; TAM grows to $4B in 3 years.
Diversified RWA stablecoins sustain 5-7% yield from real credit as crypto funding compresses to ~4%. GENIUS pushes yield off-chain; TAM grows to $4B in 3 years.
Why it matters:
Diversified RWA stablecoins sustain 5-7% yield from real credit as crypto funding compresses to ~4%. GENIUS pushes yield off-chain; TAM grows to $4B in 3 years.
Block's new voice AI sounds eerily human, sparking awe and scam fears
Bitcoin Core changes security rules as AI makes finding code bugs dangerously easy
Ethereum delays Glamsterdam test after security devs flag risk to existing contracts