How Fake ‘Stuck’ Bitcoin Transactions Pay the Attacker: Inside the Electrum 4.8.3 Patch

Bitcoin wallet Electrum shipped version 4.8.3 on October 24 to patch a flaw that let a malicious server replace a user's payment with a fake one that pays the attacker.

The wallet's developers explained the mechanism in a security advisory: Electrum is a lightweight wallet that does not run a full node, so it depends on a network of servers that anyone can operate. Those servers feed the wallet its view of unconfirmed transactions, and before 4.8.3 Electrum never checked the cryptographic signatures on what a server delivered.

How a stuck payment becomes the attacker's payment

When a user broadcasts a payment through a compromised server, the advisory describes how the server can hold the real transaction back and inject a conflicting fake one instead. The fake transaction carries an output address belonging to the attacker and a zero fee, which makes the payment look stuck. The wallet's history shows the spoofed transaction as legitimate, because nothing verifies that it came from the user.

The trap closes with fee-bumping. Electrum users who see a payment sitting unconfirmed often use replace-by-fee, signing and broadcasting a replacement transaction with a higher fee to push it through. In this attack, the replacement the user signs actually pays the attacker's address.

Electrum developer SomberNight, who wrote the advisory, also warned that an attacker can repeat the address-generation process over and over until the fake output ends in the same four characters the user's real destination does. That makes a quick glance at the address tail worthless, so checking the first characters is no safer.

Confirmed in the wild

The advisory states that some servers are performing this attack in the wild" , backed by two user reports. A user named dannydeezy flagged the behavior on October 11; in that case the fake payment stayed inside the compromised server and never reached the wider network, so nothing was stolen. Another user, Raju-K12, confirmed a loss on October 18 after fee-bumping a manipulated transaction.

The 4.8.3 patch verifies cryptographic signatures on wallet-owned inputs before adding any unconfirmed transaction to the wallet's history, which blocks server-injected fakes that touch the user's own addresses. SomberNight acknowledged in the advisory that the fix does not cover payments from outside parties, since such transactions carry no inputs belonging to the user and would still slip through without signature checks; adding that protection would take more work. Users who connect only to a server they run themselves are not affected.

The flaw is the latest turn for Electrum's open server model, which its developers have patched before: a rogue-server campaign starting in 2018 pushed fake update notifications and reportedly drained an estimated $25 million from users by 2020. That history is part of why a thin-client architecture that trusts strangers' servers keeps drawing scrutiny, as security fixes for Bitcoin software become a standing concern for wallet users.

The post How Fake Stuck' Bitcoin Transactions Pay the Attacker: Inside the Electrum 4.8.3 Patch appeared first on Techreport.