According to Woofun AI, Bitcoin's established software wallet Electrum revealed a high-risk security flaw. By tampering with transaction records to be confirmed, the malicious server tricked users into signing transfer instructions to the attackers when speeding up payments, causing funds to be stolen.
The attack exploited an architectural weakness of Electrum's reliance on an external server to obtain transaction status rather than full node verification. After taking control of the server, the attackers intercepted the user's payment information and replaced it with a false transaction with an invalid signature, causing the wallet to appear pending processing. When users try to speed up transactions through the “replace by fee” feature, Electrum will sign an effective replacement transaction based on the fraudulent transaction and transfer the BTC to the attacker's address. The attackers even set the malicious transaction fee to zero to disguise stuttering, and generate an address that is the same four digits after the legitimate recipient address to evade inspection. On October 11, a three-signature multi-signature wallet user using two Trezor hardware devices reported that the record was abnormal, confirming the existence of an attack even though no funds were lost; on October 18, another user confirmed the loss of funds due to an increase in processing fees for the replaced transaction.
According to data compiled by Woofun AI, the developers have not disclosed the exact amount of money stolen or the identity of the malicious server, but it has been confirmed that some servers are already exploiting this vulnerability to carry out attacks.
Electrum released version 4.8.3 on October 24, adding signature verification to pending transactions involving users' own funds, but the old version is still at risk. This fix is only six days since the first theft was reported, and highlights the fragility of non-full node wallets in the trust model. Following the bypass of multi-signature verification, this is another precise attack on the client's transaction logic, reminding users to upgrade the software and strictly check the receiving address and amount before signing.