Bitcoin Wallet Bug: Why Speeding Up a Payment Could Drain Your Wallet

Most $Bitcoin thefts need your seed phrase. This one did not. A flaw in Electrum, one of the oldest Bitcoin wallets, let a malicious server replace a pending payment with a fake one and then wait for you to do something completely routine: speed it up. The moment you approved the higher fee, you signed the attacker’s transaction instead of your own. At least one user lost funds before the fix landed on October 24. Here is what happened and why it matters even if you have never used Electrum.

How does the Bitcoin fee bump trap work?

Light wallets like Electrum do not download the whole blockchain. They ask external servers for your transaction history and for broadcasting payments. Confirmed transactions are checked against the chain, but pending ones were simply taken on trust from the main server the wallet happened to be connected to.

That gap was the opening. An attacker running one of those servers could intercept an outgoing payment before it reached the network, then feed the wallet a counterfeit version. The counterfeit spent your coins to an address the attacker controlled, in at least one case with the same last four characters as the real recipient, and it carried a fee so low that it would never confirm. The wallet displayed it as a legitimate pending payment.