Bitcoin developers have released a patch closing an attack route that exploited fee-bump mechanisms, the transaction-acceleration tools wallets and services rely on when network congestion pushes unconfirmed transactions to the back of the mempool. The fix addresses how Bitcoin nodes process and relay Replace-by-Fee (RBF) and Child-Pays-for-Parent (CPFP) transactions. Officials said the patch is a mandatory update rather than optional hardening, because the disclosure window after a patch release is the period of highest risk for unupgraded nodes.
The node-level issue does not involve confirmed theft of funds or compromise of private keys. Instead, it creates a path through fee-bump logic that could be abused to cause unintended behavior at the relay or policy layer. Bitcoin Core previously addressed a fund-redirect gap that similarly did not require private-key theft, showing how attack surfaces often target relay and policy enforcement rather than Bitcoin's underlying cryptographic guarantees.
In a related disclosure, Electrum warned users to upgrade to version 4.8.3 after a critical vulnerability allowed malicious servers to redirect Bitcoin payments when users raised fees through Replace-by-Fee. Electrum posted that the update fixes a critical security issue and urged all users to upgrade. The flaw affects all versions released before 4.8.3.
According to Electrum, older versions accepted some unconfirmed transactions without checking their signatures. A compromised server could intercept a payment, stop it from being broadcast, and swap in a fake transaction sending funds to an attacker's address. The fake transaction had invalid signatures but still appeared as a normal pending payment. Attackers also created addresses with the same last four characters as the real recipient, making quick address checks less likely to catch the switch. One victim reportedly lost funds after approving a fee increase.
Developers received two private reports: one on October 11 from user dannydeezy describing transaction substitution, and another on October 18 from user Raju-K12 reporting stolen funds after approving a fee bump. The issue is tracked as GitHub advisory GHSA-6jp4-8v48-cc5v, and the fix was delivered in commit 90fe308. Version 4.8.3 now checks signatures on unconfirmed transactions that spend the wallet's coins, rejecting fake transactions with invalid signatures before they enter wallet history.
Electrum users should download the update only from electrum.org and verify its cryptographic signatures. Until upgrading, they should carefully check every address and amount before signing, including during fee changes. Users who connect only to trusted, self-hosted servers are not exposed to this server-based attack. Electrum also noted that a Windows Defender warning about ZXing.dll is a false positive and should be ignored. Operators running Bitcoin nodes, payment processing infrastructure, or Lightning routing nodes should review official release documentation and test the update in a staging environment where possible.
