October 27, 2026
You bumped the fee — and sent your bitcoin to a scammer. What to do if you use Electrum
On October 24, Electrum 4.8.3 shipped a fix for a critical vulnerability. The developers confirmed that some servers were already using it against users.
HOW THE SCHEME WORKED
- Electrum learns about unconfirmed transactions from external servers. A malicious server intercepted your payment and showed a swapped one in your history — paying the scammer's address.
- The swap carried fake signatures, but versions before 4.8.3 didn't check them.
- The swap was made to look "stuck" — with a zero fee. The user hit "Increase fee" (RBF), and the wallet signed a real transaction to the scammer's address.
- The scammer's address matched the real one in its last four characters.
Two cases are known — October 11 and October 18; in one, money was lost. The developers haven't disclosed the amount.
WHAT TO DO
- Update Electrum to 4.8.3 — only from the official site electrum.org, never from ads or links in messages.
- Until you update, don't bump the fee on stuck transactions.
- Before signing, check the full recipient address, not just the start and the end. On a hardware wallet — on its screen.
- Check a stuck transaction in an independent block explorer: it shows what actually reached the network.
- If you see a transaction in your history that you never made, move the remaining funds to a new wallet on the updated version.
It's the same logic as address poisoning: the scammer counts on nobody reading the middle of an address.
Check a recipient address for free: https://t.me/amlconsensus_bot?start=en
AML