--- title: "Electrum patched a wallet flaw that let rogue servers steal bitcoin" description: "Electrum disclosed that malicious servers could replace unconfirmed payments in its wallet, then sign a valid replacement sending coins to the attacker once users raised the fee. The developers reported at least one theft and released version 4.8.3, which checks signatures on unconfirmed…" language: en canonical: "https://whycoinmoves.com/en/events/bitcoin-bitcoin-wallet-bug-let-rogue-99bbc6c1457d74" published: 2026-10-26T05:17:58.000Z updated: 2026-10-26T06:18:03.000Z indexable: true --- # Electrum patched a wallet flaw that let rogue servers steal bitcoin Electrum disclosed that malicious servers could replace unconfirmed payments in its wallet, then sign a valid replacement sending coins to the attacker once users raised the fee. The developers reported at least one theft and released version 4.8.3, which checks signatures on unconfirmed… Attributed sources: [CoinDesk]() ## Key facts Electrum disclosed that malicious servers could replace unconfirmed payments in its wallet, then sign a valid replacement sending coins to the attacker once users raised the fee. The developers reported at least one theft and released version 4.8.3, which checks signatures on unconfirmed transactions. Evidence strength: Single source, 1 publisher group(s) (CoinDesk); this describes source coverage, not truth or causation. After site detection, observed returns were 5 minutes: +0.08% (26/10/2026, 05:17 → 26/10/2026, 05:22, UTC; Gate · USDT); 1 hour: +0.07% (26/10/2026, 05:17 → 26/10/2026, 06:17, UTC; Gate · USDT). Unlisted windows are unavailable. In the preceding 30 days, the 99th percentile of absolute hourly returns was 1.01% (OKX · USDT; cutoff 26/10/2026, 05:17, UTC). This hourly baseline is not directly comparable with a minute move. ## Returns after site detection | Window | Return | BTC | Difference from BTC | Actual sampled interval (UTC) | Source | | --- | --- | --- | --- | --- | --- | | 5 minutes | +0.08% | +0.08% | 0.00 pp | 26/10/2026, 05:17 → 26/10/2026, 05:22 | Gate · USDT | | 1 hour | +0.07% | +0.07% | 0.00 pp | 26/10/2026, 05:17 → 26/10/2026, 06:17 | Gate · USDT | | 24 hours | — | — | — | — | — | ## Historical hourly baseline | Metric | Value | | --- | --- | | Ready | true | | Coverage | 100.0% (720/720) | | Median absolute hourly return | 0.14% | | 99th percentile of absolute hourly returns | 1.01% | | BTC beta | 1.00 | | Source / cutoff (UTC) | OKX · USDT / 26/10/2026, 05:17 | ## Claims and open questions - Electrum said it received two reports in October, including one from a user who lost funds on Oct. 18 after approving a fee increase on a substituted transaction; developers have not disclosed the amount stolen. - Before the fix, the wallet trusted outside servers to report pending transactions without checking whether their signatures were valid, and attackers also generated receiving addresses whose last four characters matched the legitimate destination. - Electrum released version 4.8.3 on Oct. 24 adding signature checks for unconfirmed transactions, but earlier versions remain vulnerable when connected to malicious servers. - Which servers carried out the attack, and what on-chain data would identify the addresses that received the stolen coins? - Will Electrum publish the total amount lost, and will the theft be confirmed in an official statement or filing? ## Source evidence - [Bitcoin wallet bug let rogue servers steal funds when users tried to speed up payments]() — CoinDesk; published 26/10/2026, 05:15; received 26/10/2026, 05:17 (UTC). ## Recent BTC events and market reactions - [US spot Bitcoin ETFs end two-week outflow streak with about $301 million weekly inflow]() — Published 25/10/2026, 14:01 (UTC) · Multiple publishers (2 publishers) · Market watch · 5m +0.03% / 1h +0.50% - [Bitcoin briefly slips below $80,000 as crypto longs lose $404 million in four hours]() — Published 24/10/2026, 17:44 (UTC) · Single source (1 publisher) · General news · 5m +0.09% / 1h +0.25% / 24h +0.78% - [Xapo CEO says wealthy bitcoin holders are turning to loans and yield]() — Published 24/10/2026, 14:00 (UTC) · Single source (1 publisher) · General news · 5m +0.00% / 1h -0.78% / 24h -0.46% - [Robinhood says bitcoin, gold and oil prediction markets are its fastest-growing products]() — Published 23/10/2026, 13:58 (UTC) · Single source (1 publisher) · Market watch · 5m -0.15% / 1h -0.53% / 24h -1.60% - [Block launches first mass-consumer Bitcoin ad campaign, "Bitcoin Does"]() — Published 23/10/2026, 13:21 (UTC) · Single source (1 publisher) · Project updates · 5m -0.12% / 1h -0.55% / 24h -1.30% - [Full coin archive]() ## Research for this archive - [Crypto hacks and price impact: Bybit and Cetus case studies]() - [Why is crypto moving? How to check the evidence behind a price explanation]() - [Altcoin beta to Bitcoin: BTC, ETH, SOL and DOGE hourly returns]() - [Will Bitcoin go back up? Every crash since 2011 and its recovery time]() [Methods and limitations]() Publisher count is not independent evidence count. Price changes cannot verify news or prove causation.