A flaw in bitcoin software wallet Electrum reportedly allowed cybercriminals to dupe users into signing over payments.

Complete the form to unlock this article and enjoy unlimited free access to all PYMNTS content — no additional logins required.

As CoinDesk reported Monday (Oct. 26), Electrum revealed this vulnerability over the weekend, saying some servers had begun exploiting it.

Developers had gotten two reports this month, including one from a user who lost money after approving what seemed to be a typical transaction fee increase, Coindesk said.

Electrum, unlike a full bitcoin node, uses outside servers to retrieve transaction histories and broadcast payments, the report said. Prior to the fix, the wallet trusted those servers to inform it of pending transactions but did not verify their signatures.

Please add us to your preferred sources list so our news, data and interviews show up in your feed. Thanks!

That meant an attacker controlling one of the servers could capture a payment before it reached the bitcoin network and swap it out in the wallet’s history with a phony transaction. However, the wallet showed the phony payment as pending, with users falling into the cybercriminals’ trap when they tried to speed that transaction, the report said.

Bitcoin offers a feature called Replace-by-Fee, which permits unconfirmed transactions to be replaced with versions with higher fees. If a user chose that option, Electrum could take the fraudulent transaction and approve a valid replacement, sending the funds to the attacker.

Electrum has since issued an update that includes signature checks for unconfirmed transactions that use coins from the customer’s own wallet, the CoinDesk report said.

Source link