A malicious server could silently swap your Bitcoin transaction for a fake one, and you would never know until your funds were gone.
That is the vulnerability Electrum developers just patched, and at least one user has already reported losing real money to it. The flaw, buried inside one of Bitcoin's most widely used desktop wallets, exposed users to a specific kind of man-in-the-middle attack that turned Electrum's own server infrastructure against them.
How the Attack Actually Worked
Electrum operates on a model where wallets connect to a network of public servers to broadcast transactions and fetch data. That openness is a feature. It also became the attack surface.
A bad actor running a malicious server could intercept a legitimate payment request and substitute a completely different transaction in its place. The substituted transaction would route funds to the attacker's address. Then, to cover costs and ensure the fake transaction cleared quickly on-chain, the server would quietly inflate the transaction fee.
The user, seeing what looked like a normal confirmation prompt, would sign it. Funds gone. No obvious red flags. No second chances.
This is not a theoretical exploit chain requiring exotic conditions. It required connecting to a rogue server, something that could happen passively if a user's usual server was unavailable and Electrum fell back to a public alternative.
One Confirmed Victim, Likely More
Developers confirmed that at least one user reported a financial loss tied to this vulnerability before the patch landed. That number is almost certainly conservative. Victims of silent transaction hijacking often do not immediately identify the cause, and many never report it publicly.
Electrum has not disclosed the exact amount lost, and the broader scope of how widely the malicious server infrastructure was deployed remains unclear.
What You Need to Do Right Now
If you are running Electrum, update immediately. Do not wait. Check the official Electrum website at electrum.org and verify the download signature before installing. Never download wallet updates from any third-party site, social media link, or search result.
Beyond the update, consider locking your Electrum client to a specific trusted server rather than allowing automatic server selection. This reduces exposure to rogue nodes significantly.
For larger holdings, cold storage remains the only configuration that fully removes software wallet risk from the equation. Hardware wallets require physical confirmation of transaction details on the device itself, making this category of substitution attack structurally impossible.
The Bigger Picture
This incident is a sharp reminder that self-custody is not a set-and-forget solution. Wallet software is an attack surface, and the security of your funds depends on staying current. Watch for the Electrum team's full post-mortem disclosure, which should clarify how many servers were compromised and for how long. That report will tell you a lot about the true scale of this event.