News Heat Trend
Sparrow Wallet Releases Version 2.5.4, AI-Assisted Code Review Fixes Multiple Security Vulnerabilities
According to Decrypt, privacy-focused Bitcoin wallet Sparrow Wallet released version 2.5.4 on August 28. Developer Craig Raw stated that the update was driven by an AI-assisted code review, with the majority of fixes originating from it. This review was prompted by the recent seed generation code vulnerability exploit affecting Coldcard, as well as the release of unrestricted AI models in China, which has significantly enhanced vulnerability scanning capabilities across large codebases. Key updates include: validating the authenticity of transactions returned by Electrum servers, enforcing stricter BitBox02 hardware wallet security requirements (firmware v9.4.0 or higher required), patching local DNS leaks, and masking sensitive credentials in debug logs. Raw noted that there are no indications of any exploits being leveraged, user funds remain secure, and he still advises all users to update at their earliest convenience.
Independent verification scope expanded, Sparrow Wallet releases v2.5.4 security update
Odaily News: Sparrow Wallet v2.5.4 has been released following an extensive AI-assisted review, featuring multiple security hardening updates aimed at reducing users' reliance on external servers such as Electrum.Additionally, this version strengthens Ledger, Keycard, Trezor, Payjoin, PSBT, and multi-signature handling, removes Bitcoin Core credentials and other sensitive information from debug logs, restricts permissions for existing wallet and backup directories to owner-only access, closes residual local DNS resolution leaks when using Tor, and reinforces validation for wallet import, signing, downloads, and server responses. The update expands Sparrow Wallet's scope of independent verification for transaction data, hardware devices, and other inputs, reducing dependence on data provided by external servers. (Bitcoin News)
Electrum 4.8.3 Fixes Security Vulnerability That Could Trick Users into Signing Malicious Transactions
Odaily reports: According to Bitcoin News monitoring, Electrum released version 4.8.3 on October 24, 2026, fixing a security vulnerability that has already been exploited in real attacks. Malicious servers could display fabricated transactions to users and, when users attempt to speed up transactions via Replace-by-Fee (RBF), trick them into signing transactions that pay the attacker's address; the attacker does not need to obtain the user's private keys. Electrum stated it has received two related reports, in which one user lost bitcoin after increasing the fee, and recommends that users update to version 4.8.3.
Electrum Releases Version 4.8.3 to Fix Critical Vulnerability, Preventing Malicious Servers from Tampering with Unconfirmed Transactions
Bitcoin software wallet Electrum released version 4.8.3 on October 24, fixing a critical vulnerability. Malicious servers could exploit this vulnerability to tamper with unconfirmed transactions and redirect user funds to attacker addresses; the vulnerability affects all versions prior to 4.8.3.Attackers could intercept payments broadcast by users through compromised servers and inject fake conflicting transactions displaying zero fees. If users increase the fee on a transaction that appears stuck, the newly signed and broadcast transaction could send funds to the attacker's address. At least one user reported losing funds as a result on October 18.This patch verifies the signatures of the wallet's own inputs before adding unconfirmed transactions to the local record; transactions from external senders whose inputs do not belong to the user's wallet are still not subject to signature verification. Electrum developer SomberNight stated that closing this gap will require additional work. (Decrypt)
High-risk vulnerability exploited, Electrum discloses versions before 4.8.3 affected
Odaily reports: According to Bitcoin News monitoring, Electrum has disclosed a high-risk security vulnerability in which malicious servers can trick users into sending Bitcoin to an attacker's address when users increase transaction fees. The attacker intercepts broadcast transactions and replaces them in the wallet history with a forged transaction that redirects funds to an address controlled by the attacker. If users increase fees via Replace-by-Fee (RBF), Electrum may sign the malicious transaction. Electrum confirmed receiving two related incident reports, with one user losing funds. The attacker also generated addresses with the same last four characters as the intended recipient addresses. The vulnerability affects versions prior to 4.8.3 and has been fixed in version 4.8.3. Electrum reminds users to update immediately and to verify all recipient addresses and amounts before signing transactions.
Electrum officially announced the release of version 4.8.3 and urges all users to upgrade.
The Electrum project officially announced the release of version 4.8.3, stating that it patches a critical security vulnerability and urging all users to upgrade. Details regarding the vulnerability will be disclosed at a later time. The GitHub changelog marks 4.8.3 as a security update, released on October 23. The official Electrum website advises users to download the software exclusively from their official site and verify the GPG digital signature to confirm the installer’s source and integrity.
Sparrow Wallet Releases Version 2.5.4, AI-Assisted Code Review Fixes Multiple Security Vulnerabilities
According to Decrypt, privacy-focused Bitcoin wallet Sparrow Wallet released version 2.5.4 on August 28. Developer Craig Raw stated that the update was driven by an AI-assisted code review, with the majority of fixes originating from it. This review was prompted by the recent seed generation code vulnerability exploit affecting Coldcard, as well as the release of unrestricted AI models in China, which has significantly enhanced vulnerability scanning capabilities across large codebases. Key updates include: validating the authenticity of transactions returned by Electrum servers, enforcing stricter BitBox02 hardware wallet security requirements (firmware v9.4.0 or higher required), patching local DNS leaks, and masking sensitive credentials in debug logs. Raw noted that there are no indications of any exploits being leveraged, user funds remain secure, and he still advises all users to update at their earliest convenience.
MacOS Malware Exposed: Can Hijack Telegram Sessions and Steal Crypto Wallet Data
security researchers have discovered an information-stealing malware targeting MacOS devices that is attacking crypto users. It can hijack Telegram Desktop sessions, steal passwords and wallet databases, further controlling user accounts and stealing digital assets. Affected wallets and applications include: Exodus, Atomic, Electrum, Wasabi, Monero, and others.Security experts advise that users with potentially infected devices should immediately treat them as "untrusted devices," terminate all active Telegram sessions, and change both their Telegram two-factor authentication password and desktop app password. Additionally, users should not enter seed phrases, private keys, or wallet passwords on the infected device, and should generate a new wallet and migrate their assets. (FinanceFeeds)
Electrum 4.8.3 Fixes Security Vulnerability That Could Trick Users into Signing Malicious Transactions
Odaily reports: According to Bitcoin News monitoring, Electrum released version 4.8.3 on October 24, 2026, fixing a security vulnerability that has already been exploited in real attacks. Malicious servers could display fabricated transactions to users and, when users attempt to speed up transactions via Replace-by-Fee (RBF), trick them into signing transactions that pay the attacker's address; the attacker does not need to obtain the user's private keys. Electrum stated it has received two related reports, in which one user lost bitcoin after increasing the fee, and recommends that users update to version 4.8.3.
Electrum Releases Version 4.8.3 to Fix Critical Vulnerability, Preventing Malicious Servers from Tampering with Unconfirmed Transactions
Bitcoin software wallet Electrum released version 4.8.3 on October 24, fixing a critical vulnerability. Malicious servers could exploit this vulnerability to tamper with unconfirmed transactions and redirect user funds to attacker addresses; the vulnerability affects all versions prior to 4.8.3.Attackers could intercept payments broadcast by users through compromised servers and inject fake conflicting transactions displaying zero fees. If users increase the fee on a transaction that appears stuck, the newly signed and broadcast transaction could send funds to the attacker's address. At least one user reported losing funds as a result on October 18.This patch verifies the signatures of the wallet's own inputs before adding unconfirmed transactions to the local record; transactions from external senders whose inputs do not belong to the user's wallet are still not subject to signature verification. Electrum developer SomberNight stated that closing this gap will require additional work. (Decrypt)
High-risk vulnerability exploited, Electrum discloses versions before 4.8.3 affected
Odaily reports: According to Bitcoin News monitoring, Electrum has disclosed a high-risk security vulnerability in which malicious servers can trick users into sending Bitcoin to an attacker's address when users increase transaction fees. The attacker intercepts broadcast transactions and replaces them in the wallet history with a forged transaction that redirects funds to an address controlled by the attacker. If users increase fees via Replace-by-Fee (RBF), Electrum may sign the malicious transaction. Electrum confirmed receiving two related incident reports, with one user losing funds. The attacker also generated addresses with the same last four characters as the intended recipient addresses. The vulnerability affects versions prior to 4.8.3 and has been fixed in version 4.8.3. Electrum reminds users to update immediately and to verify all recipient addresses and amounts before signing transactions.
Electrum officially announced the release of version 4.8.3 and urges all users to upgrade.
The Electrum project officially announced the release of version 4.8.3, stating that it patches a critical security vulnerability and urging all users to upgrade. Details regarding the vulnerability will be disclosed at a later time. The GitHub changelog marks 4.8.3 as a security update, released on October 23. The official Electrum website advises users to download the software exclusively from their official site and verify the GPG digital signature to confirm the installer’s source and integrity.
Electrum Releases 4.8.2 Security Update to Fix Lightning Wallet Backup Issue
Bitcoin wallet Electrum has released version 4.8.2, fixing multiple security issues, including an issue where some Lightning wallet backups were missing the keys required to recover on-chain funds after a remote force close, along with strengthened HTLC validation and Android QR scanner protection.
Electrum Releases Version 4.8.2, Fixing Critical Backup Issue for Lightning Wallets and Strengthening Security
Odaily Reports: Bitcoin News posted on X platform that Electrum has released version 4.8.2, introducing multiple security fixes and strengthening the security of its Bitcoin wallet codebase. The fixes are based on reports from researchers including Bitcoin Red Team, Calle, l0rinc, haoxucu, and m0wer. This version fixes a critical backup issue affecting certain Lightning wallets that use non-deterministic keys and anchor channels. Previously, affected wallets' channel backups and full wallet backups may have been missing the keys required to move funds on-chain after requesting a remote force close. Affected users will receive a warning when starting Electrum and should export new backups, as old backups cannot correctly recover funds in this scenario. This version also strengthens Lightning HTLC verification, rejects previously accepted malformed xpub/xprv keys, expands codebase security hardening, and prevents the Android QR code scanner from reading screenshots. This is Electrum's third security-focused release since July, following versions 4.8.0 and 4.8.1.
Related news
Electrum 4.8.3 Fixes Security Vulnerability That Could Trick Users into Signing Malicious Transactions
Odaily reports: According to Bitcoin News monitoring, Electrum released version 4.8.3 on October 24, 2026, fixing a security vulnerability that has already been exploited in real attacks. Malicious servers could display fabricated transactions to users and, when users attempt to speed up transactions via Replace-by-Fee (RBF), trick them into signing transactions that pay the attacker's address; the attacker does not need to obtain the user's private keys. Electrum stated it has received two related reports, in which one user lost bitcoin after increasing the fee, and recommends that users update to version 4.8.3.
Electrum Releases Version 4.8.3 to Fix Critical Vulnerability, Preventing Malicious Servers from Tampering with Unconfirmed Transactions
Bitcoin software wallet Electrum released version 4.8.3 on October 24, fixing a critical vulnerability. Malicious servers could exploit this vulnerability to tamper with unconfirmed transactions and redirect user funds to attacker addresses; the vulnerability affects all versions prior to 4.8.3.Attackers could intercept payments broadcast by users through compromised servers and inject fake conflicting transactions displaying zero fees. If users increase the fee on a transaction that appears stuck, the newly signed and broadcast transaction could send funds to the attacker's address. At least one user reported losing funds as a result on October 18.This patch verifies the signatures of the wallet's own inputs before adding unconfirmed transactions to the local record; transactions from external senders whose inputs do not belong to the user's wallet are still not subject to signature verification. Electrum developer SomberNight stated that closing this gap will require additional work. (Decrypt)
High-risk vulnerability exploited, Electrum discloses versions before 4.8.3 affected
Odaily reports: According to Bitcoin News monitoring, Electrum has disclosed a high-risk security vulnerability in which malicious servers can trick users into sending Bitcoin to an attacker's address when users increase transaction fees. The attacker intercepts broadcast transactions and replaces them in the wallet history with a forged transaction that redirects funds to an address controlled by the attacker. If users increase fees via Replace-by-Fee (RBF), Electrum may sign the malicious transaction. Electrum confirmed receiving two related incident reports, with one user losing funds. The attacker also generated addresses with the same last four characters as the intended recipient addresses. The vulnerability affects versions prior to 4.8.3 and has been fixed in version 4.8.3. Electrum reminds users to update immediately and to verify all recipient addresses and amounts before signing transactions.
Electrum officially announced the release of version 4.8.3 and urges all users to upgrade.
The Electrum project officially announced the release of version 4.8.3, stating that it patches a critical security vulnerability and urging all users to upgrade. Details regarding the vulnerability will be disclosed at a later time. The GitHub changelog marks 4.8.3 as a security update, released on October 23. The official Electrum website advises users to download the software exclusively from their official site and verify the GPG digital signature to confirm the installer’s source and integrity.
OneKey Founder: SafeOS is Built on FreeRTOS, Compatibility to Continue Expanding
OneKey founder Yishi stated in a post that OneKey's SafeOS is built on FreeRTOS and independently developed by the team. OneKey will always focus on portable security devices, providing additional offline hardware security protection for real-world assets (RWA), crypto assets, as well as FIDO keys and two-factor authentication (2FA). Yishi also emphasized that OneKey will serve as a universal accessory for iPhone and Mac, allowing users to pair OneKey with wallets such as BlueWallet, Sparrow, Rabby, OKX Wallet, MetaMask, Electrum, and more. The team will continue to expand its compatibility range.
Electrum Releases 4.8.2 Security Update to Fix Lightning Wallet Backup Issue
Bitcoin wallet Electrum has released version 4.8.2, fixing multiple security issues, including an issue where some Lightning wallet backups were missing the keys required to recover on-chain funds after a remote force close, along with strengthened HTLC validation and Android QR scanner protection.