Bitcoin wallet bug let rogue servers steal funds when users tried to speed up payments
The Electrum Bitcoin wallet has disclosed a vulnerability that allowed malicious servers to steal funds by tricking users into signing fraudulent transactions. The attack exploited the wallet's reliance on external servers and the 'Replace-by-Fee' feature to siphon coins.
Why it matters
This highlights the security risks inherent in light-client wallet architectures that rely on third-party servers, posing a threat to user asset security.
Electrum, one of Bitcoin's oldest software wallets, disclosed the vulnerability on Saturday , saying some servers were already exploiting it. The developers received two reports in October, including one from a user who lost funds after approving what appeared to be a routine transaction-fee increase.
The attack exploited how Electrum handles bitcoin payments that have not yet been confirmed by the network.
Unlike a full Bitcoin node, Electrum relies on outside servers to retrieve transaction histories and broadcast payments. Before the fix, the wallet trusted those servers to report pending transactions without checking whether their signatures were valid.
An attacker controlling one of those servers could intercept a payment before it reached the Bitcoin network and replace it in the wallet's history with a fake transaction. This replacement spent the user's coins to an address controlled by the attacker, using invalid signatures that Electrum failed to detect.
Get smarter about the news
Sign up free for a feed built around what you actually care about, Dive Deeper research on any story, and the full text of every article.
Create free accountAlready have an account? Sign in