Zero Radar
← feed
CriticalVulnerabilityCVE-2026-117601updated 28 Oct 2026, 21:24 UTC

Electrum wallet can be tricked into signing a fake, zero-fee transaction

A malicious Electrum server can swap your just-sent Bitcoin transaction for a fake one that sends the money to the attacker. If you then fee-bump it in the wallet, you sign and pay the attacker.

Fix availableOfficial, 2 sources
SeverityCriticalCVSS 9.3 of 10
Being exploited?UnclearNo reports either way yet
Fix available?YesElectrum 4.8.3 (fix in commit 90fe30822, binaries released 2026-10-24) · since 27 Oct 2026
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1You broadcast a transactionSent through your Electrum wallet
  2. 2Malicious server swallows itOriginal never reaches the Bitcoin network
  3. 3Fake transaction shownInvalid zero-fee copy pays attacker address
  4. 4You fee-bump and signWallet trusts the fake without checking signatures
  5. ResultAttacker receives your funds

What happened

Electrum before 4.8.3 does not verify signatures of wallet-owned inputs on unconfirmed mempool transactions returned by the server, so a malicious server can replace a broadcast transaction with a conflicting, invalid one whose outputs point to an attacker address.

Why it is dangerous: Users of Electrum who connect to untrusted or third-party servers can lose funds; the flaw is being exploited in the wild, and at least two users reported losing money.

Are you affected?

You are affected if you run Electrum older than 4.8.3 and connect to a server you do not control.

Package / productAffected versionsFixed in
electrum · pip< 4.8.34.8.3

What to do

  1. Upgrade Electrum to version 4.8.3 or later
  2. Until upgraded, check that output addresses and amounts are as expected before signing any transaction, including fee bumps
  3. Prefer connecting to servers you trust, such as your own

Timeline

  1. 27 Oct 2026, 14:16 UTC
    Publicly disclosed
  2. 27 Oct 2026, 14:16 UTC
    Reported by NVD · NVD
  3. 27 Oct 2026, 14:19 UTC
    Picked up by Zero Radar
  4. 28 Oct 2026, 21:24 UTC
    GitHub Advisory reported on it · GitHub Advisory
  5. 28 Oct 2026, 21:24 UTC
    Fixed version published: electrum 4.8.3 · GitHub Advisory

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-117601 · GHSA-6jp4-8v48-cc5v
CVSS
9.3 / 10
EPSS
0.2% chance of exploitation within 30 days
Disclosed
27 Oct 2026, 14:16 UTC
On Zero Radar
27 Oct 2026, 14:19 UTC (3 min after disclosure)
Last change
28 Oct 2026, 21:24 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Electrum wallet can be tricked into signing a fake, zero-fee transaction · Zero Radar