Key points
- Electrum versions before 4.8.3 are affected by the disclosed attack.
- A manual fee bump can authorise the substituted payment.
- Upgrade from the official site and verify the download signature.
A Bitcoin payment stalls. You raise the fee to get it moving. That routine decision is the opening in a newly disclosed Electrum attack.
For users of the Bitcoin ($BTC) wallet, the immediate action is straightforward: update through the official download route, then check the complete destination and amount before signing. A familiar-looking address ending is insufficient.
The payment changes before you sign again
In an October 24 advisory, Electrum describes a hostile server withholding a broadcast payment and inserting a conflicting transaction into the wallet history. Its outputs point to the attacker. The substituted transaction initially has invalid signatures.
The dangerous step comes when the user manually raises its fee through replace-by-fee, or RBF. The wallet can then sign a valid payment to the substituted destination. The advisory classifies the issue as high severity, affects versions before 4.8.3 and identifies 4.8.3 as patched.
Developers say they received two user reports, including one reported loss after a fee bump. They also report attacker destinations matching the intended address’s final four characters. These are developer-reported incidents; the advisory does not establish an industry-wide loss total.
The fix checks signatures for wallet-owned inputs before adding unconfirmed transactions to local history. Connections to a trusted server, including a user’s own server, are outside the affected scenario described by the advisory.
Update the app. Verify the download.
The release notes date 4.8.3 to October 23 and label it a security update. Odaily’s October 24 report independently confirms the release and upgrade warning; its early report preceded the detailed disclosure.
Use electrum.org as the download starting point. The official site lists 4.8.3 and provides detached signatures alongside its packages. Its instructions explain how to verify the signing key and recommend checking the key fingerprint through an independent source. A matching file hash alone cannot establish who supplied a file.
An urgent update is also an opportunity for impersonators. Avoid installation files delivered through replies, private messages or lookalike domains. Never send a recovery phrase to someone offering update assistance.
What holders should check now
Before making another payment, confirm the installed version. Before signing—including a fee bump—check the full recipient address and amount against the intended payment. If the history shows a payment you do not recognise, investigate before authorising a replacement.
This disclosure concerns wallet software and its server relationship. It does not show that Bitcoin’s consensus rules accepted invalid signatures. The user’s later signature is what makes the described theft possible. That distinction matters: holding your own keys still requires scrutiny of what the wallet asks those keys to approve.
For broader operational context, see Panther’s Bitcoin Core security-policy report. The common lesson is to make verified updates part of normal maintenance, rather than wait for a loss to make them urgent.
Panther Takeaway
A fee bump should change the price of confirmation, not the person you pay. Install the verified update and read the payment again before signing.
PANTHER JOURNAL #057. Verification: official advisory, release notes and download page, cross-checked against Odaily. Checked October 25, 2026. Cover: conceptual illustration, not evidence of a specific victim’s wallet.
Responses
No responses yet. Start the conversation.
Panther Journal — The intelligence brief
Stay ahead of the story.
Free. New investigations delivered when published. Unsubscribe anytime.
