Electrum patches wallet flaw exploited to redirect Bitcoin payments

Electrum released a security update after malicious servers exploited a flaw in older versions of its Bitcoin wallet to substitute pending payments, allowing users who tried to raise transaction fees to authorize transfers to attackers. Developers say at least one user reported losing Bitcoin, but have not disclosed the amount or the number of affected users. The vulnerability affected versions released before Electrum 4.8.3. Electrum relies on external servers for information about unconfirmed transactions. According to the developers, a malicious server could withhold a legitimate payment and show the wallet a replacement directing funds to an attacker-controlled address. Older versions did not check the replacement transaction’s signatures before displaying it in the wallet history. The substituted transaction could initially appear to be pending despite having invalid signatures. If a user then used Bitcoin’s Replace-by-Fee feature to increase its fee, the wallet could create valid signatures for the altered payment. That could authorize the transfer without the attacker obtaining the user’s private keys. Developers received two user reports in October. The first, on Oct....