Electrum 4.8.3 Fixes a Bitcoin Theft Flaw: How to Update and Check Your Wallet

Electrum, one of the oldest Bitcoin wallets, released version 4.8.3 on October 24, 2026 to fix a high-severity flaw that its developers say malicious servers were already exploiting. A rogue server could hide a payment you had just sent, show a fake one paying an attacker, and wait for you to "bump" its fee, at which point your wallet would sign a real payment to the thief.

Every version before 4.8.3 is affected, and at least one user lost money, according to the project's GitHub security advisory. If you use Electrum on a desktop or Android phone, the fix is simple: update, and read the full address before you sign anything. This guide walks through what happened, who is exposed and exactly what to do.

Key facts at a glance

• The fix: Electrum 4.8.3, labelled a security update in the official release notes. The advisory ID is GHSA-6jp4-8v48-cc5v, rated High, with no CVE assigned as of October 25.
• Who is exposed: anyone on a version older than 4.8.3 who connects to public Electrum servers, which is the default.
• How theft happens: only if you approve a fee increase on a fake pending transaction. The server cannot move your coins on its own.
• Confirmed harm: two private reports, on October 11 and October 18, and one user who lost funds after bumping a fee.
• The disguise: the attacker's address was generated to match the last four characters of the real one.

Why so many people are searching for this now

The advisory went public at 12:52 UTC on Saturday, October 24, alongside the new downloads. The developers urged all users to upgrade on X.

The timing matters because the attack targets an everyday action. Raising the fee on a slow transaction is routine when the network is busy, and Electrum's own FAQ tells users how to do it. That makes the trap easy to fall into for anyone who does not know about it.

How the attack works, in plain English

Electrum is a light client, meaning it does not download the whole blockchain. Instead it asks servers about your transactions. The Electrum FAQ explains that the wallet keeps connections to about 10 servers, but one "main" server handles your address history and broadcasts your payments. Confirmed transactions are checked against block data, but "the server is trusted about unconfirmed transactions."

The advisory describes how attackers abused that trust:

1. You send a payment. A malicious main server quietly swallows it instead of passing it to the Bitcoin network.
2. The server reports a fake. It tells your wallet about a different transaction that spends the same coins but pays an attacker's address.
3. The fake has invalid signatures, so the network would never accept it. Before 4.8.3, Electrum did not check those signatures for pending transactions, so it showed the fake as your own payment.
4. You bump the fee. If you use replace-by-fee (RBF), the feature that re-signs a stuck payment with a higher fee, your wallet signs a brand-new, valid transaction to the attacker.

One fraudulent transaction carried a zero fee, apparently to make it look stuck and invite the very fee bump needed to complete the theft.

Why checking the last few characters was not enough

Both reporting users said the attacker's address had been "grinded" to match the last four characters of the genuine address. In the first user's case both addresses ended in "GyQ3", and generating an address with a chosen short ending is cheap. A quick glance at the end of an address is not verification.

Who is affected

You are exposed if you run any Electrum version before 4.8.3 and connect to public servers, which is the default behaviour.

You may already be affected if, in recent weeks, you bumped the fee on a payment that looked stuck, especially one showing an address you did not recognise or an unusually low fee.

You are not affected by this specific attack if you connect only to a server you trust, such as one you run yourself. The developers say so in the advisory, though you should still update for the release's other fixes.

Hardware wallet users are partly protected. A device such as a Trezor ensures the transaction you approve is the one that gets signed. But a fee bump is a new transaction, so you still need to read every output on the device screen.

Step-by-step: how to protect your wallet

1. Back up your seed first

The FAQ advises: "always save your wallet seed on paper before doing an upgrade." Your wallet files are stored separately from the program, so installing the new version keeps them, but a paper backup is your safety net.

2. Download 4.8.3 only from electrum.org

The official download page lists 4.8.3 as the latest release for Windows, macOS, Linux and Android, with Android also available on Google Play and F-Droid. The site warns: "Do not download Electrum from a source other than electrum.org." The project's FAQ lists malicious clones of the app among the common ways users lose money.

3. Verify the download's signature

Electrum publishes a signature file (.asc) beside each download. The site says the current files were signed by five builders, including ThomasV and SomberNight. On Linux, the project's documentation shows the command gpg --verify <electrum file>.asc <electrum file>, which should report a "Good signature". Check the signer's key fingerprint against an independent source.

The FAQ also warns not to downgrade after opening your wallet with a newer version, because an older version may not read the updated wallet file.

4. Be careful with Linux distribution packages

Not every app store had caught up as of October 25:

If your package manager still shows an older version, use the official download until it updates.

5. Until you can update, check every signature in full

The advisory's workaround is short: when signing any transaction, whether you are bumping the fee or not, "verify the output addresses and amounts are as expected." Compare the whole address, not just the ending, ideally by copying it again from its original source.

How to tell if you have been targeted

Look through your outgoing transactions from the past few weeks. Warning signs described in the advisory include:

• A pending payment that changed. The first user noticed that, after sending, the history showed a different transaction from the one they had just broadcast.
• A destination you did not enter, or a second small output you did not expect.
• A fee of almost nothing, making the payment appear stuck.
• A payment that never reached the network. Look up the transaction ID on a block explorer you trust or your own node.

The advice is direct: if a payment you just sent suddenly shows a different address, do not bump it. Reconnect to another server and check a block explorer.

What to do if you think you were hit

Do not sign anything further on the suspicious transaction. If you already bumped a fee, compare the confirmed transaction's outputs with the address you meant to pay, character by character.

Keep your wallet files and logs, and contact the developers through the channels listed on electrum.org. Bitcoin transactions cannot be reversed, so preserving evidence matters if you report the theft.

Watch for follow-up scams. Electrum's FAQ lists people "posing as support" among common ways users lose money. Never share your seed phrase with anyone who contacts you offering help.

What the developers and experts say

The advisory is candid about limits. Electrum developer SomberNight writes that "some servers are performing this attack in the wild." The fix makes the wallet verify signatures on pending transactions that spend your own coins, but incoming pending payments are still not checked, because the light wallet lacks a full validation engine.

The same gap remains: if attackers move to faking incoming payments, the trade-off at the heart of light wallets will return. No list of malicious servers and no amount lost has been published, so the full scale is unknown.

Electrum also warned on X that Windows Defender may wrongly flag a file in the new Windows build, calling it a false positive.

Takeaways

1. Update to Electrum 4.8.3 today, downloaded only from electrum.org, after backing up your seed on paper.
2. Verify the download's signature and avoid outdated Flathub or Debian packages until they reach 4.8.3.
3. Read the full address and amount on every signing request, including fee bumps, and on your hardware wallet's screen if you use one.
4. Never bump a fee on a pending payment that shows an address or amount you did not choose. Check a block explorer first.
5. Consider a server you trust. Users who connect only to their own or a trusted server were not exposed to this attack.