Here is what the Electrum advisory and the reporting say, with the limits noted.
Who is affected: every Electrum version before 4.8.3. The fix is in 4.8.3. Electrum says wallets connected only to servers you run yourself are not affected. The advisory is GHSA-6jp4-8v48-cc5v on GitHub, as reported by Bitcoin.com.
How the attack works: a malicious server withholds your broadcast transaction and shows a conflicting one in your history, paying an attacker's address. That substitute carries invalid signatures, but older versions displayed it as pending without checking them. If you then bump the fee with RBF, the wallet signs the altered transaction. Attacker addresses were made to match the last four characters of the intended address, so a quick glance at the ending does not protect you.
What is confirmed: Electrum received two reports, and one user lost funds after raising a fee. The amount was not disclosed. Reports differ on the release date: the changelog says October 23, while news coverage dates it October 24.
What to do: update to 4.8.3, and check the full recipient address and amount before signing, including fee bumps. The fix checks signatures on inputs spending your own coins, so it closes this path, but as the GlobalCrypto analysis notes, it does not verify every unconfirmed parent transaction.
🕒 As of October 2026
