The team behind the Electrum bitcoin wallet released version 4.8.3 on 24 October, fixing a bug that malicious servers had exploited. The servers sent the wallet fake unsigned pending transactions, and when users tried to speed up a payment by raising its fee, they actually signed a transaction to the attacker. Reports of the problem arrived on 11 and 18 October, including at least one theft. Users who connected only to servers they trust were not exposed.

What it means: Electrum is one of the oldest and most widely used bitcoin wallets, and the attack shows an often underrated weakness: light wallets rely on third-party servers to learn which transactions are pending, and if that server is malicious it can present a misleading picture. The fee-bump feature, very useful when the network is busy, became the point of attack. For Greek users the steps are clear: update to version 4.8.3 from the official website, verify the signature of the installer and carefully check the recipient address in every transaction before signing. Those who run their own bitcoin node can connect Electrum only to their own server, which removes this risk. Hardware devices that show the real address on their screen also offer protection, as long as the user actually checks what they approve. For businesses that accept or hold bitcoin, the case is a reminder that payment procedures should include a second check of the address and limited use of software wallets for large amounts.

Read the original on CoinDesk

Related service: Custom software

Related stories