The official release notes identify 4.8.3 as a security update. A published advisory now explains the disclosed attack and confirms reports of exploitation. The advisory rates this particular vulnerability as high severity.
For anyone using Electrum to send Bitcoin into a swap, the immediate concern is the transaction they approve. Keeping control of private keys does not remove the need to check what wallet software asks those keys to sign.
How a fee increase could redirect a payment
According to Electrum's security advisory, a malicious server could withhold a newly broadcast transaction and make the wallet display a conflicting transaction instead. The replacement pointed to the attacker's address. Its signatures were invalid, but the older client could still show it as an unconfirmed payment.
The decisive step came when the user increased that payment's fee through replace-by-fee, usually called RBF. Signing the replacement could turn the previously invalid transaction into a valid payment to the attacker. The danger therefore involved a deceptive transaction history followed by the user's signature, rather than a server simply obtaining the wallet's private keys.
Which users need to update
The advisory lists versions earlier than 4.8.3 as affected and 4.8.3 as patched. It says clients connected to trusted servers, such as a server the user runs, are not affected by this specific attack. That exception should not be mistaken for a reason to stop installing security updates.
The described exploit requires transaction activity and signing. It does not establish that an untouched offline wallet can be drained merely because an old Electrum version exists on a computer. Conversely, holding your own keys is not sufficient protection against approving a manipulated payment. Our crypto wallet guide explains the responsibilities that come with self-custody.
Update without handing over your recovery phrase
Electrum's official download page lists the release and its signatures. Its documentation explains that wallet files are stored separately from the application. A normal update is a software installation, not a request to transfer funds to a new address.
- Check that your recovery backup is available and stored offline before changing the software. Do not photograph or upload the phrase as part of an update.
- Obtain the installer only through Electrum's official download page. Avoid adverts, direct messages and download buttons supplied by an unexpected warning.
- Verify the matching GPG signature using the project's instructions. Check the signing key's fingerprint through an independent trusted source; a downloaded key alone does not establish authenticity.
- Install the verified release, reopen the wallet and check its version. Never enter a seed phrase on a website or into a pop-up claiming that an update or security check requires it.
Signature verification checks who signed the downloaded file and whether it has changed. It does not make every future payment safe. If verification fails or you cannot establish the correct signing key, pause the installation and resolve that discrepancy through official documentation.
Check the payment, not just its status
Before signing, compare the full destination address, amount and fee with your intended payment. The advisory says the attacker addresses in the two reported cases matched the final four characters of the legitimate addresses. Checking only an address's ending would therefore have missed the substitution.
An unexpected pending transaction deserves investigation before a fee increase. Consult our crypto scams guide for warning signs and the sending and receiving guide for transfer checks. A payment appearing in wallet history is not, by itself, proof that it is the payment you created or that the network accepted it.
What the disclosure does not establish
Electrum reports two user accounts of the attack, including one user who lost funds after increasing the fee. It also says malicious servers are carrying it out. The advisory does not provide a verified total for victims or losses, so those reports should not be presented as the complete scale of the incident.
The patch adds signature checks for unconfirmed transaction inputs belonging to the wallet. Electrum also explains that it remains a lightweight client with limits on what it validates. Updating addresses the disclosed flaw; reviewing each payment remains necessary when sending or swapping Bitcoin.
