Electrum: Fake 'Stuck' Bitcoin Payments Tricked Users Into Paying Thieves

On Saturday 24 October 2026 the developers of Electrum, one of the oldest bitcoin wallet apps, told users to update at once. Some of the computers the app relies on for information had been caught lying to it. They were hiding real payments, showing fake ones in their place, and waiting for the user to make one small, routine click that would send the money to a thief.

The developers' security advisory on GitHub, filed as GHSA-6jp4-8v48-cc5v and published by the developer known as SomberNight, rates the flaw high severity and says plainly that "some servers are performing this attack in the wild". Every Electrum version before 4.8.3 is affected. Two users reported it. At least one of them lost bitcoin. How much has not been made public, and the advisory does not name the servers involved.

What Electrum is, and why it asks strangers for information

Electrum has been around since 2011, when it was started by the German developer Thomas Voegtlin. It is a light wallet: rather than downloading the whole bitcoin record of every payment ever made, which runs to hundreds of gigabytes, it asks outside computers called servers what is happening with the user's money. Anyone can run one of these servers, and the app connects to them automatically. In stock-market terms, it is like a trading app that gets its prices from whichever data feed happens to answer, rather than straight from the exchange.

For payments that are already confirmed, Electrum double-checks what servers say. For payments that are still waiting, it has always trusted its main server. The advisory calls that a documented design choice.

What a stuck payment is

A bitcoin payment is not final the moment it is sent. It first waits in a public queue called the mempool, until one of the computers that keep the bitcoin record picks it up and writes it into the next block, the next page of the ledger. That usually takes minutes. The payer attaches a fee, and the people writing blocks pick the best-paying payments first. Pay too little and a payment can sit in the queue for hours or days. That is a stuck payment.

Bitcoin has a standard way out, called replace-by-fee. The payer signs a new version of the same payment with a higher fee, and the new one replaces the old in the queue. Electrum offers it as a simple button to bump the fee. It is a normal, everyday thing to do, which is exactly what made it useful to a thief.

How the trick worked

The advisory sets out the sequence. A user sends bitcoin. A dishonest server quietly holds that payment back instead of passing it on to the network. It then tells the wallet about a different payment, apparently from the same user, that sends the money to the attacker. This fake payment is invalid: it does not carry the user's real signature, so the bitcoin network would never accept it. But older Electrum versions did not check signatures on waiting payments. The wallet hid the real payment and showed the fake one as pending.

Two details made the fake convincing. Both victims said the thief's address ended in the same four characters as the address they meant to pay, so a quick glance at the end of the address looked right. This is a close cousin of address poisoning, where thieves create look-alike addresses to fool people who check only the first or last few characters. And in the case that cost money, the fake payment carried a fee of zero, so it would obviously sit there stuck.

The user then did the sensible thing and bumped the fee. Electrum built a new version of the payment the screen was showing, the attacker's version, and this time signed it properly with the user's own key. That real, valid payment went to the thief. It is the online version of a text saying a parcel is stuck at customs and a small fee will release it, except that here the fee button was inside the user's own wallet.

Who reported it

According to the advisory, the first user sent a private report on 11 October, after noticing that the wallet's history showed a different payment from the one sent. That user lost nothing and also found that the real payment had never reached the wider bitcoin network, which showed a server had held it back. Bitcoin.com News identified this reporter as the GitHub user dannydeezy. At that point the fee-bump danger had not been understood. On 18 October a second user, Raju-K12, reported losing money after bumping the fee. The fix was tagged on 23 October, and the finished version 4.8.3 was released and the flaw made public on 24 October.

Version 4.8.3 now checks the signatures on any waiting payment that spends the wallet's own coins before showing it. Incoming payments are still not fully checked, the advisory says, because doing that properly would need the wallet to verify the whole chain of unconfirmed payments behind them. Users who connect only to a server they run themselves, or one they trust, were never exposed.

Not the first time Electrum's servers were turned on its users

Electrum's open network of servers has been abused before. From 21 December 2018, according to Electrum's developers as reported by The Block, attackers added dozens of malicious servers that popped up a message telling users their wallet needed an update. The link led to a fake version on GitHub that stole their bitcoin. The Block put the first losses at over 200 bitcoin, about $730,000 at the time. Older versions let servers show messages with any text and formatting, which made the fake warnings look official. By April 2019 the security company Malwarebytes estimated the campaign had taken well over 771 bitcoin, about $4 million then, and was being backed by a network of more than 72,000 hijacked computers flooding honest servers.

The lesson from both episodes is the same: a light wallet is only as honest as the servers it listens to.