News linked to both this project and an event.
Odaily reports: According to Bitcoin News monitoring, Electrum released version 4.8.3 on October 24, 2026, fixing a security vulnerability that has already been exploited in real attacks. Malicious servers could display fabricated transactions to users and, when users attempt to speed up transactions via Replace-by-Fee (RBF), trick them into signing transactions that pay the attacker's address; the attacker does not need to obtain the user's private keys. Electrum stated it has received two related reports, in which one user lost bitcoin after increasing the fee, and recommends that users update to version 4.8.3.
Bitcoin software wallet Electrum released version 4.8.3 on October 24, fixing a critical vulnerability. Malicious servers could exploit this vulnerability to tamper with unconfirmed transactions and redirect user funds to attacker addresses; the vulnerability affects all versions prior to 4.8.3.Attackers could intercept payments broadcast by users through compromised servers and inject fake conflicting transactions displaying zero fees. If users increase the fee on a transaction that appears stuck, the newly signed and broadcast transaction could send funds to the attacker's address. At least one user reported losing funds as a result on October 18.This patch verifies the signatures of the wallet's own inputs before adding unconfirmed transactions to the local record; transactions from external senders whose inputs do not belong to the user's wallet are still not subject to signature verification. Electrum developer SomberNight stated that closing this gap will require additional work. (Decrypt)
Odaily reports: According to Bitcoin News monitoring, Electrum has disclosed a high-risk security vulnerability in which malicious servers can trick users into sending Bitcoin to an attacker's address when users increase transaction fees. The attacker intercepts broadcast transactions and replaces them in the wallet history with a forged transaction that redirects funds to an address controlled by the attacker. If users increase fees via Replace-by-Fee (RBF), Electrum may sign the malicious transaction. Electrum confirmed receiving two related incident reports, with one user losing funds. The attacker also generated addresses with the same last four characters as the intended recipient addresses. The vulnerability affects versions prior to 4.8.3 and has been fixed in version 4.8.3. Electrum reminds users to update immediately and to verify all recipient addresses and amounts before signing transactions.
The Electrum project officially announced the release of version 4.8.3, stating that it patches a critical security vulnerability and urging all users to upgrade. Details regarding the vulnerability will be disclosed at a later time. The GitHub changelog marks 4.8.3 as a security update, released on October 23. The official Electrum website advises users to download the software exclusively from their official site and verify the GPG digital signature to confirm the installer’s source and integrity.
Bitcoin wallet Electrum has released version 4.8.2, fixing multiple security issues, including an issue where some Lightning wallet backups were missing the keys required to recover on-chain funds after a remote force close, along with strengthened HTLC validation and Android QR scanner protection.
Odaily Reports: Bitcoin News posted on X platform that Electrum has released version 4.8.2, introducing multiple security fixes and strengthening the security of its Bitcoin wallet codebase. The fixes are based on reports from researchers including Bitcoin Red Team, Calle, l0rinc, haoxucu, and m0wer. This version fixes a critical backup issue affecting certain Lightning wallets that use non-deterministic keys and anchor channels. Previously, affected wallets' channel backups and full wallet backups may have been missing the keys required to move funds on-chain after requesting a remote force close. Affected users will receive a warning when starting Electrum and should export new backups, as old backups cannot correctly recover funds in this scenario. This version also strengthens Lightning HTLC verification, rejects previously accepted malformed xpub/xprv keys, expands codebase security hardening, and prevents the Android QR code scanner from reading screenshots. This is Electrum's third security-focused release since July, following versions 4.8.0 and 4.8.1.
According to Decrypt, privacy-focused Bitcoin wallet Sparrow Wallet released version 2.5.4 on August 28. Developer Craig Raw stated that the update was driven by an AI-assisted code review, with the majority of fixes originating from it. This review was prompted by the recent seed generation code vulnerability exploit affecting Coldcard, as well as the release of unrestricted AI models in China, which has significantly enhanced vulnerability scanning capabilities across large codebases. Key updates include: validating the authenticity of transactions returned by Electrum servers, enforcing stricter BitBox02 hardware wallet security requirements (firmware v9.4.0 or higher required), patching local DNS leaks, and masking sensitive credentials in debug logs. Raw noted that there are no indications of any exploits being leveraged, user funds remain secure, and he still advises all users to update at their earliest convenience.
Odaily News: Sparrow Wallet v2.5.4 has been released following an extensive AI-assisted review, featuring multiple security hardening updates aimed at reducing users' reliance on external servers such as Electrum.Additionally, this version strengthens Ledger, Keycard, Trezor, Payjoin, PSBT, and multi-signature handling, removes Bitcoin Core credentials and other sensitive information from debug logs, restricts permissions for existing wallet and backup directories to owner-only access, closes residual local DNS resolution leaks when using Tor, and reinforces validation for wallet import, signing, downloads, and server responses. The update expands Sparrow Wallet's scope of independent verification for transaction data, hardware devices, and other inputs, reducing dependence on data provided by external servers. (Bitcoin News)