Electrum releases version 4.8.3 to fix critical BTC theft vulnerability

The Electrum Bitcoin wallet, one of the most widely used light clients in the world, released a critical update (version 4.8.3) on October 24, 2026, to fix a security flaw that allowed for the theft of bitcoins. This vulnerability, classified as "high" by experts, potentially exposes the funds of over one million users, recalling the inherent risks of non-custodial software solutions in an ecosystem where security remains a major issue. Context Electrum, developed since 2011 by a Switzerland-based team, is a light wallet (SPV) that allows users to manage their bitcoins without downloading the entire blockchain. Unlike full wallets like Bitcoin Core, Electrum relies on third-party servers to validate transactions, an approach that reduces technical requirements but introduces external dependencies. According to CryptoScore Pro data as of October 25, 2026, the software has approximately 1.2 million monthly active users, representing nearly 0.03% of active Bitcoin addresses. The corrected flaw occurs within a context of increased vigilance surrounding light wallets, whose vulnerabilities have been exploited in the past. In 2023, a similar attack targeted mobile wallet users, resulting in estimated losses of several million dollars. Furthermore, the Bitcoin market, although less volatile than in 2024, remains sensitive to security announcements: the price of BTC fell by 0.4% on the day the update was released, according to CryptoScore Pro data. The Facts The vulnerability, identified as a "man-in-the-middle" type bug, allowed a malicious server to intercept user requests and substitute the destination address of a transaction with an address controlled by the attacker. According to Electrum's official security advisory, this flaw affected all versions prior to 4.8.3, including 4.8.2, which was widely deployed within the French-speaking community. Key dates and figures : October 24, 2026: release of version 4.8.3 for Windows, macOS, and Linux, available at electrum.org . October 11 and 18, 2026: two reports of attacks exploiting the flaw, one of which resulted in a loss of funds for a user. CVSS score higher than 7.0, qualifying the vulnerability as "high" severity. 1.2 million monthly active users (source: CryptoScore Pro, data as of October 25, 2026). Attack mechanism : A compromised server held a legitimate transaction and replaced it with a fraudulent transaction, displayed in the wallet history. The fraudulent addresses mimicked the last four characters of the legitimate recipient's address to deceive the user. The Replace-by-Fee (RBF) function, which allows increasing the fees of a transaction, could be hijacked to validate the fraudulent transaction. Developer response : Thomas Vasquez, lead developer of Electrum, recommended an immediate update and published a migration guide on the official forum. Version 4.8.3 introduces signature verification for unconfirmed transactions and mutual TLS authentication for server connections. Users connected to their own trusted server are not exposed to this flaw. No incidents of massive loss of funds have been confirmed to date, but developers emphasize that the lack of public data on the exact number of affected users limits the assessment of actual exposure. Furthermore, a phishing alert targeting Electrum users has been reported on social networks, without its link to the flaw being established. Understanding key concepts Lightweight wallet (SPV) A light wallet, or Simplified Payment Verification (SPV), is software that allows for the management of cryptocurrencies without downloading the entire blockchain. Unlike a full node, which stores and verifies all transactions since the network's creation, an SPV wallet queries third-party servers to obtain the necessary information (such as balances or pending transactions). For example, Electrum uses this system to provide a faster user experience that is less resource-intensive. However, this approach relies on the trust placed in the servers, which can expose users to risks of manipulation, as seen in the case of the corrected vulnerability. Man-in-the-middle (MITM) A man-in-the-middle (MITM) attack occurs when an attacker positions themselves between two communicating parties (in this case, a user and an Electrum server) to intercept, modify, or redirect the exchanged data. In the case of Electrum, the attacker could substitute the destination address of a transaction with their own without the user noticing. This type of attack is particularly dangerous in decentralized networks, where the absence of a centralized trusted third party makes fraud detection more complex. A concrete example would be a hacker intercepting a transaction of 1 BTC to a legitimate address and redirecting it to their own wallet. Replace-by-Fee (RBF) The Replace-by-Fee (RBF) function is a Bitcoin protocol mechanism that allows a user to increase the fees of an unconfirmed transaction to accelerate its processing by the network. For example, if a transaction takes too long to be validated due to fees being too low, the user can create a new version of that transaction with higher fees, which will replace the old one. However, this function can be misused: in the case of the Electrum vulnerability, an attacker exploited RBF to induce the user to sign a fraudulent transaction by increasing the fees of a fake transaction, thereby validating the theft of funds. Mutual TLS Authentication Mutual TLS authentication (Transport Layer Security) is a security protocol that ensures both parties in a communication (in this case, the Electrum wallet and its server) mutually authenticate each other before exchanging data. Unlike classic TLS, where only the server proves its identity, mutual authentication requires the client (the user) to also present a valid certificate. In version 4.8.3 of Electrum, this measure aims to prevent MITM attacks by ensuring that the queried servers are indeed the expected ones. For example, if a user…