The Electrum wallet hack disclosed on 24 October 2026 didn't break into Electrum or steal anyone's keys. Attackers running their own Electrum servers hid a user's outgoing payment, showed a fake one in its place, and waited for the user to raise the fee on it, at which point the wallet signed a fresh transaction that paid the attacker. If you use Electrum, update to version 4.8.3 from electrum.org and check the full receiving address and amount before you sign anything, fee bumps included. If you're still choosing where to keep your bitcoin, the useful lesson is about which screen you trust when money moves.
What happened in the Electrum wallet hack
Electrum is a light Bitcoin wallet, which means it doesn't download the whole blockchain and asks public servers for your transaction history instead. According to the project's security advisory GHSA-6jp4-8v48-cc5v, rated high severity and published by Electrum developer SomberNight, older versions trusted those servers with unconfirmed transactions without checking their signatures.
A hostile server could exploit that in a few steps. When you broadcast a payment, the server held it back from the Bitcoin network and slipped a conflicting transaction into your wallet's history, one that paid the attacker's address instead of your recipient. That fake had invalid signatures and could never confirm on its own, but your wallet displayed it as a normal pending payment and hid the original.
The trap closed when the user tried to speed things up. Bitcoin lets you replace a stuck transaction with a higher-fee version, a feature called Replace-by-Fee, and Electrum would build that replacement from the fake transaction it was showing. Your keys then produced a valid signature on a payment to the attacker, and that one did confirm.
Two details made it harder to spot. The advisory says the attacker's address was reportedly generated so its last four characters matched the address you meant to pay, and the fake transaction reportedly carried a zero fee, which nudges anyone watching it sit unconfirmed toward bumping it.
How much was lost
Nobody has published a total. The advisory records two private reports: the first arrived on 11 October from a user who saw a different transaction in their history after broadcasting, and the second arrived on 18 October from a user who lost funds after a fee bump. Developers say some servers are running this attack in the wild, and Bitcoin.com News notes that the amount taken hasn't been disclosed. Version 4.8.3 was tagged on 23 October, with release files following a day later.
Are you affected?
Every Electrum version before 4.8.3 is affected, and the risk depends on what you did with it. If you broadcast a payment, saw it confirm, and never bumped a fee on something that looked stuck, the attack had nothing to work with. If you raised the fee on a pending payment recently, check that transaction's outputs in a block explorer against the address you meant to pay, character by character.
The fix in 4.8.3 makes the wallet verify signatures on unconfirmed transactions that spend your own coins before showing them. The advisory is open about its limits: the client still can't fully validate every incoming transaction, because a light wallet doesn't run the full rules of Bitcoin. If you connect only to an Electrum server you run yourself, or one you trust, this attack doesn't reach you.
What to do now
Download 4.8.3 only from electrum.org and verify the release signature as the site explains. Treat any update link that arrives by message, pop-up or email with suspicion, because Electrum's 2018 losses came from exactly that kind of fake update prompt, a history we went through in our piece on whether the Electrum wallet is safe.
Until you've updated, read the full receiving address and the amount before every signature, including when you bump a fee. Checking the first and last few characters isn't enough here, since the attacker chose an address built to pass that glance.
Would a hardware wallet have stopped it?
A hardware wallet paired with Electrum would have signed the attacker's replacement too, if you approved it, because the problem was what the wallet asked you to sign rather than where the key lived. What changes is where you check. A signing device shows the destination and amount of the transaction it's about to sign on its own screen, which a compromised server can't edit, so the attacker's address would have appeared there before you pressed approve. That protection only works if you read the whole address on the device, and it doesn't replace updating the software.
The broader point holds for any wallet you pick. Your balance and history come from servers or apps that can be wrong or hostile, and the device screen at the moment of signing is the last place you can catch it. Our checklist on your first hardware wallet puts that screen near the top of what to look for.
Where Ryder One fits
We should be clear about one limit: Ryder One can't act as a signer for Electrum or any other desktop wallet today, so if Electrum is the interface you want to keep, pair it with a device that supports it. Ryder One works through the Ryder app on your phone and talks to it over NFC only, with no Bluetooth, no Wi-Fi and no wired data transfer. When you send, the recipient address and amount appear on the Ryder One touchscreen, and nothing is signed until you approve it there.
If you're moving coins off an exchange and comparing options, the question this incident raises is a good one to ask of every wallet on your list: when you approve a payment, where do you see where it's going, and could anything between you and the network change it?
Share: