Loading...
Electrum has released version 4.8.3, fixing a critical security vulnerability and urging users to upgrade as soon as possible. This vulnerability is quite dangerous: A malicious server could intercept a transaction you just broadcast and then insert a fake transaction with a replaced recipient address into your wallet history. The fake transaction originally lacked a valid signature, but older wallets might display it as an unconfirmed transaction. If you find the transaction is not confirmed for a long time and click RBF to accelerate and re-sign it, you might actually transfer BTC to a hacker. The official team has received two related reports, one of which resulted in a user losing funds. Even more alarming is that the hacker deliberately made the last four digits of the fake address match the real address, specifically exploiting users' habit of only checking the last four digits. We recommend that everyone: 1️⃣ Upgrade to 4.8.3 as soon as possible, only download and verify GPG signatures from the official website, and be wary of fake update links. 2️⃣ Do not arbitrarily accelerate abnormal unconfirmed transactions with RBF before upgrading. 3️⃣ Always verify the complete receiving address and amount before each signature. If using a hardware wallet, confirm this on the device screen as well. 4️⃣ If possible, connect to your own Electrum server, but this cannot replace timely upgrades. This incident reminds us again: Just because your private key isn't leaked doesn't mean your funds are safe. Before signing, you must confirm what you are signing. Official vulnerability description: https://(github.com)/spesmilo/electrum/security/advisories/GHSA-6jp4-8v48-cc5v