WORLDTECHElectrum patches flaw that let malicious servers redirect Bitcoin payments
The Bitcoin wallet Electrum has shipped version 4.8.3 to close a high-severity vulnerability that allowed malicious servers to send payments elsewhere when users tried to raise transaction fees. The developers confirmed the flaw was being actively exploited and told users to upgrade.
How the redirection worked
The weakness stems from Electrum's reliance on external servers to keep track of unconfirmed transactions. A hostile server can withhold a transaction from the network and offer a conflicting version that routes the funds to an address controlled by the attacker, which alters the payment details a user sees before approving extra fees.
The fraudulent transaction initially carries invalid signatures, so it cannot be processed as a legitimate payment. The attackers generated lookalike addresses whose final four characters matched those of the intended recipients, a method that may fool users who only check part of an address.
Developers confirm exploitation
The developers made the vulnerability public on Oct. 24 and confirmed that malicious servers had used it, with at least one user losing Bitcoin after approving a fraudulent transaction without realising it. Two user complaints preceded the disclosure, one from a person who spotted an unfamiliar transaction after sending a payment and another who lost money while trying to speed up a pending transfer.
The flaw affects Electrum versions earlier than 4.8.3. Electrum has not said how much was taken, and the number of affected wallets is still unknown.
Open questions
- How many wallets were compromised?
- What total amount of Bitcoin was stolen?
- How many servers were used in the attacks?