Electrum wallet flaw let rogue servers steal bitcoin through fee bumps
In brief
- Malicious Electrum servers could trick users into signing payments to attackers during fee bumps, developers said.
- At least one theft confirmed by developers; some servers were already exploiting the flaw.
- Electrum 4.8.3, released Oct. 24, adds signature checks for unconfirmed transactions.
- Earlier Electrum versions remain vulnerable when connected to malicious servers, according to the developers.
How the attack worked
Electrum isn't a full Bitcoin node. It relies on outside servers to retrieve transaction histories and broadcast payments, and before the fix the wallet trusted those servers to report pending transactions without checking whether their signatures were valid.
That was the opening.
According to the developers' disclosure, an attacker controlling a server could intercept a payment and replace it in the wallet's history with a fake transaction (one spending the user's coins to an attacker address, using invalid signatures). Replace-by-Fee is what turned that into a theft. It's the Bitcoin feature that lets an unconfirmed transaction be swapped for a version carrying a higher fee. If a user picked that option, Electrum could sign a valid replacement of the fraudulent transaction and send the coins to the attacker.
In one reported case, the malicious transaction carried no fee at all, so it looked stuck. Who wouldn't bump the fee on that? Attackers also generated receiving addresses whose last four characters matched the legitimate destination.
Two reports in October
Electrum developers received two reports in October. The first, submitted Oct. 11, involved a two-of-three multisignature wallet using two Trezor hardware devices, and that user didn't report losing funds. A second user reported on Oct. 18 that they'd raised the fee on a substituted transaction and lost money.
The developers haven't disclosed how much was stolen. They also haven't identified the malicious servers.
The fix
Electrum released version 4.8.3 on Oct. 24, adding signature checks for unconfirmed transactions that spend coins from the user's own wallet. The fix came six days after the first reported theft. Earlier versions remain vulnerable to the attack when they're connected to malicious servers, per the developers.
Users connected only to servers they trust (including their own) weren't exposed. The developers recommend upgrading and checking receiving addresses and amounts before signing payments.
Frequently asked questions
How did the Electrum fee-bump attack steal funds?
A malicious server could replace a user's payment in the wallet history with a fake transaction sending coins to an attacker address with invalid signatures. If the user then used Replace-by-Fee to raise the fee, Electrum could sign a valid replacement of that fraudulent transaction, sending the coins to the attacker.
Which Electrum versions are affected?
Electrum released version 4.8.3 on Oct. 24, adding signature checks for unconfirmed transactions spending coins from the user's own wallet. The developers said earlier versions remain vulnerable to the attack when connected to malicious servers.
Who was not exposed to the Electrum vulnerability?
Users connected only to servers they trust, including their own, were not exposed to the attack. The developers recommend upgrading and checking receiving addresses and amounts before signing payments.
