Electrum 4.8.3 fixes Bitcoin wallet flaw abused by malicious servers in an RBF trick

What happened

Electrum shipped version 4.8.3 of its Bitcoin wallet on 24 October 2026. It is a security update. The project urges all users to upgrade.

The fix covers advisory GHSA-6jp4-8v48-cc5v. Electrum rates it High. Its title: "Malicious server can replace a just-broadcast tx and try to trick user into RBF-ing it."

The release is genuine. We checked this because fake Electrum updates are a common lure. The timeline:

• 11 October 2026: first private report, from dannydeezy.
• 18 October: a second report, from Raju-K12, after a real loss of funds.
• 23 October: the fix landed (commit 90fe308). The 4.8.3 git tag was created and signed by Electrum developer SomberNight.
• 24 October: binaries went live on download.electrum.org. Electrum announced the release on its official X account and on nostr. The advisory went public the same day.

Who is affected

Every Electrum version before 4.8.3 is affected. Version 4.8.3 fixes it.

Electrum is a light client. It relies on an Electrum server to learn about unconfirmed (mempool) transactions. Electrum documents that the main server is trusted for this data.

Users who connect only to a server they run or trust are not affected, per the advisory.

What is confirmed

A malicious server could hide the transaction a user just broadcast. It could then put a fake, conflicting transaction in the wallet history.

That fake transaction had invalid signatures. Older clients did not check signatures on unconfirmed transactions. So the wallet showed the fake one as a normal pending payment.

The fake sent the funds to an attacker address. That address was crafted to share the last four characters of the real one. The fake also carried a zero fee.

The trap is the fee bump. If the user used Replace-By-Fee (RBF) to speed it up, the wallet signed the fake for real. The money then went to the attacker.

Exploited in the wild. The advisory says "some servers are performing this attack in the wild." Electrum received two user reports. One user lost money after bumping the fee.

The fix. Electrum 4.8.3 now verifies signatures of the wallet's own inputs in unconfirmed transactions before adding them to history.

Known limit. Only the wallet's own inputs are checked. Incoming transactions are still not validated this way. Electrum says the light client has no full script engine for that.

The ZXing.dll note is official. Electrum's announcement warns that Windows Defender may flag ZXing.dll. It calls this a false positive. Version 4.8.3 adds zxing-cpp for QR code scanning, and the Windows build bundles that DLL. This only holds for files from the official domains with a valid GPG signature.

What is not confirmed

• CVE. No CVE id has been assigned yet. Track it as GHSA-6jp4-8v48-cc5v.
• CVSS. Electrum has published no CVSS score. The rating is High, from the advisory. ThreatWire does not invent a score.
• Scale. Electrum has not said how many servers took part, or how much was stolen.
• Attacker. No operator or group has been named.
• Other fixes. The release notes also credit tokenistq and Amadeus29. Only one advisory is public so far.
• Public PoC. We found none. ThreatWire does not publish exploit details.

What to do

1. Upgrade to Electrum 4.8.3. Download it only from electrum.org or download.electrum.org. Android users can also use Google Play or F-Droid.
2. Verify the GPG signature before the first run. ThomasV's key fingerprint is 6694 D8DE 7BE8 EE56 31BE D950 2BD5 824B 7F94 70E6. Electrum does not publish hashes; the signature is the check.
3. Can't upgrade yet? Check every output address and amount before you sign anything. That includes fee bumps.
4. Be wary of odd history. A pending payment to an address you do not recognise is a red flag. Do not bump its fee.
5. Use a server you trust, or run your own, if you can.
6. Avoid fakes. Electrum does not buy ads. Lookalike sites push trojanized builds. Recent examples include cryptowalletelectrum[.]com and electrum-hub[.]org. Never enter your seed phrase on a website.

Related coverage

Hardware wallets face supply-chain risks too: see Ledger CryptoBilis tampered wallets and seed theft.

Sources: Electrum advisory GHSA-6jp4-8v48-cc5v, Electrum RELEASE-NOTES, the fix commit and 4.8.3 tag on GitHub, electrum.org, the official download directory, Electrum's announcement on X, and Electrum's malware guide. Links are in the references list.