Malicious Electrum servers trick users into signing payments

What happened

Electrum’s developer reports real losses from malicious servers that replaced a newly broadcast payment in the wallet’s displayed history. A user who then manually increased its fee could sign a payment to the attacker.

The developer received a private report of an actual loss on 18 October and publicly disclosed the issue on 24 October. The amount lost was not published. Versions before 4.8.3 are affected; 4.8.3 checks signatures before adding these unconfirmed transactions to local history. The attack requires a malicious server and the user’s subsequent fee-bump signature.