A security flaw allowed malicious servers to redirect Bitcoin payments when users raised transaction fees, prompting an emergency software update.

Bitcoin wallet Electrum has patched a security flaw that allowed hackers to redirect payments when users tried to increase transaction fees.

The developers disclosed the vulnerability on Oct. 24, confirming that malicious servers had exploited the weakness and that at least one user lost Bitcoin after unknowingly approving a fraudulent transaction.

The high-severity vulnerability affects Electrum versions earlier than 4.8.3. It exploits the wallet's reliance on external servers to track unconfirmed transactions, allowing attackers to manipulate the payment information users see before they authorize additional fees.

The disclosure followed two complaints received on Oct. 11 and Oct. 18. The first user noticed an unfamiliar transaction appearing in their wallet after broadcasting a payment, while the second reported losing funds after attempting to accelerate a pending transfer.

Both incidents involved attackers generating Bitcoin addresses that matched the final four characters of the intended recipients' addresses, potentially deceiving users who relied on partial address checks.

Electrum did not disclose the amount stolen, although its maintainers confirmed that some servers were actively carrying out the attack.

The exploit takes advantage of a weakness in how Electrum processes transaction information supplied by its connected servers.

When a user broadcasts a Bitcoin payment, a malicious server can withhold the transaction from the network and instead supply a conflicting version that redirects the funds to an attacker-controlled address.

The fraudulent transaction initially contains invalid signatures, meaning it cannot be processed as a legitimate payment.

Source link