Luis Arroyo 🏴‍☠️

There's a bug in Electrum, a popular Bitcoin wallet, and attackers are already using it. If you use Electrum, update to version 4.8.3 now! Here's how the attack works.. Electrum doesn't download the whole blockchain. Unless you run your own server, it asks someone else's server what's happening with your wallet. A dishonest server can abuse that trust. 1. You send a payment. The dishonest server quietly throws it away, so it never reaches the Bitcoin network. 2. The server then shows your wallet a fake pending payment that sends your coins to the attacker instead. The attacker's address is made to end with the same characters as the real one, so it looks right at a glance. 3. The fake has no fee, so it looks stuck. Older Electrum versions don't check its signatures, so they show it as your own payment. 4. You do what anyone would do with a stuck payment. You speed it up by raising the fee (a "fee bump", also called RBF). Your wallet signs a brand new, valid version of the fake, and now the attacker really gets paid. At least one person has already lost money this way. Checking only the last few characters of an address won't protect you here. Check the whole address and the amount before you sign. How EntropyLab helps. EntropyLab never connects to the internet, so no server can slip it a fake transaction. Its PSBT Inspector, the tool that shows exactly what a transaction does before you sign it, has a section called "Check a fee bump". Before you speed up a payment, paste in the original transaction you saved when you first sent it, then inspect the speed-up transaction your wallet wants you to sign. If any payment now goes to a different address or a different amount, it shows red with "A payment was changed or removed." In this attack, that's exactly what you'd see. One catch. The check is only as good as the original you give it. Use the copy you saved when you first sent the payment, not the one your wallet shows you now, because that one may be the fake. Compared with the fake, the bump looks fine. No saved copy? The PSBT Inspector still shows the full address and amount of every payment. Compare the whole address with the one you meant to pay, not just the last few characters.