Electrum published a security advisory on Saturday describing a flaw that had already been exploited: malicious servers could insert fake pending payments into transaction histories. When a user increased the fee on a stalled payment through the Replace-by-Fee mechanism, Electrum could sign a valid transaction sending the user’s bitcoins to the attacker. At least one user suffered a loss, while a first report from October 11 resulted in no theft. Version 4.8.3, released on October 24, adds signature checks for unconfirmed transactions spending the user’s funds, while older versions remain vulnerable.
Source: Read the original article
Disclaimer: this content is for information purposes only and is not financial advice. Cryptocurrencies are highly volatile: you may lose all of your capital. Always do your own research. Legal notice
