Electrum 4.8.3 fixes malicious-server transaction swap

Not stated in value. Per Electrum: 'some servers are performing this attack in the wild'; two user reports, one of whom 'bumped the fee of tx2 and lost money'.

Root cause: Per Electrum: light-client design trusts the server for unconfirmed transactions and did not verify signatures on them. Fix (commit 90fe308) verifies signatures of the wallet's own inputs for mempool transactions before adding them to history. Incoming transactions are still not validated.

Timeline, as sourced: Advisory published 24 Oct 2026 12:52 UTC; 4.8.3 binaries released 24 Oct; fix tagged 23 Oct (per Electrum).

On 24 October 2026 Electrum published a security advisory (opens in a new tab) for versions before 4.8.3. Electrum trusts the server it connects to for unconfirmed transactions. According to the advisory, a malicious server can withhold a transaction the user has just broadcast and show the wallet a conflicting transaction with invalid signatures that sends the funds to an attacker address, ground to match the last four characters of the real one. If the user then fee-bumps that transaction, the wallet signs a valid payment to the attacker. Electrum says some servers are doing this in the wild and that it received two reports, one involving lost funds. Version 4.8.3 (opens in a new tab) verifies signatures on the wallet's own inputs before showing unconfirmed transactions. Electrum advises upgrading and checking output addresses and amounts before signing any transaction.