Electrum Bug in Older Versions: You Tapped "Speed Up" and Signed a Different Payment
Two addresses with the same ending and different beginnings. With older Electrum connected to a malicious server, one fee-bump click could sign a payment to the attacker. Fixed in 4.8.3; checking the whole address helps in any wallet.
Clicking loads the YouTube player (youtube-nocookie)
Chapters
- 0:00Do these two addresses look the same?
- 0:03Same ending, different beginning
- 0:17A malicious server swaps the payment
- 0:34You tap "speed up"
- 0:50What 4.8.3 fixed
- 1:00The habit of checking addresses
About this video
Two addresses with the same ending and different beginnings. With older Electrum connected to a malicious server, one fee-bump click could sign a payment to the attacker. Fixed in 4.8.3; checking the whole address helps in any wallet.
Narrated in Chinese with burned-in Chinese subtitles. An English transcript is coming; the written version in English is linked below.
Sources
- Electrum 安全公告 GHSA-6jp4-8v48-cc5v（2026-10-24）：https://github.com/spesmilo/electrum/security/advisories/GHSA-6jp4-8v48-cc5v
- Electrum 发布说明 Release 4.8.3（2026-10-23）
Visuals are illustrations; facts follow the cited sources. Not investment advice. IKOL · AI-assisted research, human-edited.