Bitcoin Wallet Fixes Critical Flaw That Redirected Funds to Attackers

{"heading_1":"The Electrum Wallet Vulnerability","exploration_1":"The Electrum wallet, known for its trust model for unconfirmed transactions, was compromised by a high-severity exploit that allowed attackers to manipulate pending Bitcoin transactions and redirect funds to attacker-controlled addresses.","exploration_2":"The vulnerability was patched in version 4.8.3, which is now available. The fix verifies signatures on wallet-owned inputs before displaying unconfirmed transactions, closing the main attack surface.","exploration_3":"The vulnerability was exploited by attackers who used a compromised server to inject fake transactions, making the real payment appear as if it was stuck. Users who fee-bumped the fake transaction would sign and broadcast a new valid transaction, redirecting funds to the attacker.","exploration_4":"The vulnerability was reported by two users, with the second user reporting a confirmed loss of funds. The patch was tagged in the repository on October 23 and binaries were published the following day.","exploration_5":"The vulnerability was not the first time Electrum had dealt with malicious attacks. In 2018, a campaign used rogue servers to push fake update notifications, draining an estimated $25 million from Electrum users."}