Electrum wallet GHSA-6jp4-8v48-cc5v: malicious server can swap my unconfirmed Bitcoin transaction and steal funds on fee bump (RBF) — is 4.8.3 the fix?

Am I affected: you are if you run Electrum (the Bitcoin wallet) before 4.8.3. A malicious Electrum server could replace a transaction you just broadcast with a fake conflicting one in your wallet history. If you then bumped the fee on what you saw (Replace-by-Fee), you could end up signing a real transaction that sends funds to the attacker. Older versions trusted the server's view of unconfirmed transactions without checking signatures on your own inputs. The advisory was published October 24, 2026, and at least one theft has been reported. If you only connect to an Electrum server you run and trust yourself, you weren't exposed to this attack. How to check: in Electrum, open Help → About for the version. Also check which server you're connected to (Tools → Network) and whether auto-connect to public servers is enabled. Fix: upgrade to Electrum 4.8.3 or later. Download it only from the official site (electrum.org) and verify the GPG signature. Fake 'update' prompts and lookalike download sites have long targeted Electrum users, so never install an update a server message points you to. 4.8.3 validates signatures on your wallet's own inputs in unconfirmed transactions before adding them to history. Interim mitigation until you upgrade: before signing anything, including fee bumps and cancellations, check every output address and amount on the confirmation screen, and on your hardware wallet display if you use one. Avoid RBF on transactions that look different from what you sent, and prefer a server you run yourself (for example Electrum Personal Server or electrs on your own node). After upgrading: look over recent history for transactions whose outputs you don't recognize and check them in a block explorer. If funds went to an unknown address, they can't be recovered on-chain. Record the transaction IDs and report the theft. Wallet seeds were not exposed by this flaw, so you don't need to move to a new seed unless you also installed software from an unofficial source. Sources: https://github.com/spesmilo/electrum/security/advisories/GHSA-6jp4-8v48-cc5v https://crypto.news/electrum-wallet-bitcoin-theft-security-flaw-4-8-3/ https://www.kucoin.com/news/flash/electrum-wallet-patches-security-vulnerability-hackers-steal-bitcoin