Replace BY FEE

Electrum has released version 4.8.3 after a flaw allowed malicious servers to substitute fake unconfirmed Bitcoin transactions and trick users into authorizing attacker payments. At least one theft was confirmed, while users running earlier versions may remain exposed when connected to malicious servers.

A new wave of bitcoin sweeps tied to Coldcard-generated addresses may have lifted observed losses to about 1,816 BTC, or nearly $114 million, since July 30. Researchers say the latest pending transactions appear to use replace-by-fee, giving alert users a narrow window to outbid the attacker before confirmation.