Electrum patches Bitcoin vulnerability allowing payment redirection

Electrum has fixed a security flaw that enabled hackers to redirect Bitcoin payments when users attempted to increase transaction fees. The vulnerability, affecting versions prior to 4.8.3, was disclosed on Oct. 24 after malicious servers exploited it, resulting in at least one user losing Bitcoin due to a fraudulent transaction approval. The flaw arises from the wallet's dependence on external servers for tracking unconfirmed transactions, allowing attackers to manipulate payment information seen by users. Two complaints were reported on Oct. 11 and Oct. 18, with one user noticing an unfamiliar transaction and another losing funds while trying to accelerate a pending transfer. Attackers generated Bitcoin addresses matching the last four characters of intended recipients' addresses, deceiving users relying on partial checks. The exploit allows a malicious server to withhold legitimate transactions and substitute them with fraudulent ones, which users might unknowingly approve by increasing fees. Electrum's update on Oct. 23 introduced signature checks for wallet-owned inputs, preventing this substitution technique. Users are advised to download the patch and verify recipient addresses and payment amounts.

This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.