Security Flaw in Electrum Leads to Loss During Bitcoin Transfer

While mainstream assets in the cryptocurrency market traded with limited movements, a security vulnerability emerging in the infrastructure of Electrum, one of the sector's oldest software wallets, caused a loss of funds. Bitcoin, according to data as of October 26 at 05:33, traded at the $80,055.66 level with a flat daily change of 0.02%, while its 24-hour trading volume was approximately $16.5 billion. In contrast to Bitcoin, which fluctuated between $79,343.66 and $80,173.53 during the day, the market's 2nd-largest asset, Ethereum, traded at the $2,318.48 level with a 0.37% decline in the same timeframe, recording a volume of approximately $7.9 billion.

How does the vulnerability in Electrum work?

Against the backdrop of the calm course in the market, Electrum developers announced that they received 2 separate reports during October due to a vulnerability exploited by malicious servers. It was determined that the wallet, which connects to external servers to retrieve transaction history and relay payments to the network, did not perform signature verification on unconfirmed transactions that spend the user's balance. A malicious server was able to insert a fake transaction into the wallet history before the real transfer reached the Bitcoin network. While this transaction with an invalid signature appeared as pending in the wallet, attackers matched the last 4 characters of the recipient address with the real destination, making it difficult to notice the change during verification.

How can users protect themselves from the attack?

The designed mechanism was triggered when the user wanted to speed up the transfer. Using the Replace-by-Fee (RBF) feature on the Bitcoin network, the wallet based the fee bump on the fake transaction and, signing it validly this time, transferred the coins to the attacker's address. In 1 of the reported cases, because the fee of the fake transaction was set to 0, the payment appeared stuck. In the 1st incident on October 11, 1 user in a multi-signature setup using 2 Trezor hardware wallets noticed the situation and did not experience a loss. In the 2nd case on October 18, however, the user who increased the transfer fee lost their money; the stolen amount and the identities of the malicious servers were not disclosed.

Electrum developers patched the vulnerability with version 4.8.3 released on October 24. With the new update, mandatory signature verification was added for unconfirmed transactions spending assets in the wallet. Emphasizing that earlier versions continue to carry risk when connecting to malicious servers, developers recommended updating the application and verifying the recipient address and amount before signing a transaction. It was stated that users connecting only to servers under their own control or that they trust were not exposed to the attack.

This content is for information purposes only and does not constitute investment advice.