
Electrum 4.8.3 fixes flaw that let malicious servers redirect Bitcoin payments
- —A malicious server dropped the user's real transaction and injected a conflicting zero-fee one paying the attacker
- —Electrum did not verify signatures on unconfirmed transactions supplied by servers
- —The attacker can even match the last four characters of the intended address
- —All versions before 4.8.3 are affected; incoming transactions from external senders still go unverified
Why it matters: Electrum is one of the oldest and most widely used Bitcoin wallets, so users should update to 4.8.3 immediately.
Source: Cryptonaute