Critical Security Release: Please update to Electrum 3.0.5

[Darooghe]

Should we install new version and make new seeds then transfer all old balances to new one?
Who pays the fee?

[1714034614]

1714034614

[1714034614]

1714034614

[1714034614]

1714034614

[macit800]

I use 3.0.1 version. Is there a guide or video where I can see how to upload to a new version?

[jackg]

Should we install new version and make new seeds then transfer all old balances to new one?
Who pays the fee?

That's unnecessary, theymos states here and there is also a little insight into what would happen if you had been hacked and how to notice it. If you do want a clean wallet, you can transfer to your new wallet. Don't expect a dev to pay for your fees though as it's open source and "offered with no warranty". If you had a password set on your wallet, it should be more difficult to hack your wallet using json responses from a server.

I use 3.0.1 version. Is there a guide or video where I can see how to upload to a new version?

Providing you have your seed written down, just run through the next install and put your seed into it when asked.

[MCLXS411]

If you update to 3.0.4., is there still a threat ?

[schyter]

I don't know about the technicalities or how they are to hack the software with all the mnemonics attached. When I saw the flash message early in the day, I upgraded immediately and my wallet is already password protected. I hope everything is safe and everyone is able to stop panicking especially those who are not on the forum to read the warning and the progress that has been made. Electrum is one wallet that to a large extent has been able to create a niche for itself and I think vulnerability at this time will tarnish the over the years reputation.

You are right.
1. I am protected by a decent wallet password
2. I only use mozilla browser
3. I have upgraded to the v3.0.4

Nevertheless, this vulnerability is getting into my head too much.
Its image has already been tarnished with me and it may be the same with other people and is likely to last for years.
I love electrum though for its light-weight feature and other features as well.

Maybe i should give electrum a second chance

[DooMAD]

If you update to 3.0.4., is there still a threat ?

By their very nature, vulnerabilities like this can only be patched once they're discovered.  3.0.4 fixes this threat, but there could always be others.  Always remember that there's an entire internet full of potentially dangerous people out there who would much rather see some Bitcoin in their wallet rather than yours.  It's ultimately your responsibility to secure the computers or devices that you use to store your funds.  Human nature means it's easy to get complacent about security, but that leads to breaches and potential loss of your funds.  Always be vigilant.  Keep backups, use strong passwords, be wary of browsing the internet with JavaScript fully enabled, don't allow your devices to be infected with keyloggers or other malware, don't leave large sums in a single wallet, and consider things like cold storage, multisig and paper wallets.

[schyter]

Let me get something straight.

I simply installed v 3.0.4 to overwrite current version
Is this appropriate??

Or do i have to completely uninstall the old version, and then reinstall the new v 3.0.4  and then do a restore of the wallet

[inastorytold]

Apologies for basic question, but just wanted to check the following:

I have an older version (2.8.x)
I have not split my forked coins - everything has been untouched for some time.
Am I correct in thinking I can just download the latest version and it will open my current wallet by default, leaving all forked coins intact and accessible until I manage to stop being such a luddite and learn how to separate them?

Thanks in advance.

[TheQuin]

Apologies for basic question, but just wanted to check the following:

I have an older version (2.8.x)
I have not split my forked coins - everything has been untouched for some time.
Am I correct in thinking I can just download the latest version and it will open my current wallet by default, leaving all forked coins intact and accessible until I manage to stop being such a luddite and learn how to separate them?

Thanks in advance.

Yes, that would work fine. Always make sure you have written down your seed phrase before upgrading just in case. You'll find instructions on how to split the coins on this board of the forum when you're ready to do it. If you're not using Electrum then there is also no hurry to upgrade. Just don't open the old Electrum and surf the web at the same time.

[BitcoinSupremo]

Apologies for basic question, but just wanted to check the following:

I have an older version (2.8.x)
I have not split my forked coins - everything has been untouched for some time.
Am I correct in thinking I can just download the latest version and it will open my current wallet by default, leaving all forked coins intact and accessible until I manage to stop being such a luddite and learn how to separate them?

Thanks in advance.

I was in the same situation as you , I had version 2.9.3 sitting around from a lot of time so I just installed the latest version from the official electrum website and I checked my balance and my settings, everything was untouched so I guess I am safe. Still I have not a big amount in my electrum wallet as I keep majority of my coins in Ledger HW.1 hardware wallet.

[gishab56]

Oh shit!

I have 13.5BTC in my Electrum wallet with passwords protected but not very strong. i haven't claimed any forks yet. I use windows 10 with a licensed Kaspersky security. what are best advices for me?

[vlom]

Oh shit!

I have 13.5BTC in my Electrum wallet with passwords protected but not very strong. i haven't claimed any forks yet. I use windows 10 with a licensed Kaspersky security. what are best advices for me?

if you really have 13.5 BTC then i would buy a hardware wallet.  
https://www.ledgerwallet.com or https://trezor.io.

[hatshepsut93]

Oh shit!

I have 13.5BTC in my Electrum wallet with passwords protected but not very strong. i haven't claimed any forks yet. I use windows 10 with a licensed Kaspersky security. what are best advices for me?

If you have BTC on an online Windows machine, you have pretty high risk of getting robbed at some point, and it's even worse if you have weak password. Antivirus programs are not making you immune to attacks, they are just preventing some small numbers of attacks. You should start doing research about security before it's too late - 13.5 BTC is a huge sum and it's absolutely worth all the hours and days you will spend learning. The common advice is to get a hardware wallet, but even then you have to know some basic stuff to avoid some risks.

[Niya]

Do you know if latest Electron Cash version is safe to use or not?

[TheQuin]

Do you know if latest Electron Cash version is safe to use or not?

As it was forked from the same software the current version had the same issue. They have also released an update that you should upgrade to.

[jerry0]

Okay can someone explain exactly the issue here?

So what if you are using a version of electrum that is version 2.x and never upgraded for a while?  Do you need to upgrade to the new electrum 3.0.4?

Also i have upgraded electrum few times when it was say electrum 2.3 to 2.5 etc.  I have done this few times to the new version.  But when you do this, does it require you to type down the 12 word phrase each time on the new wallet?  I do not recall if it did or not.  Also are you fine using electrum version 2.x as it is without upgrading right now? 

[jackg]

Okay can someone explain exactly the issue here?

So what if you are using a version of electrum that is version 2.x and never upgraded for a while?  Do you need to upgrade to the new electrum 3.0.4?

Also i have upgraded electrum few times when it was say electrum 2.3 to 2.5 etc.  I have done this few times to the new version.  But when you do this, does it require you to type down the 12 word phrase each time on the new wallet?  I do not recall if it did or not.  Also are you fine using electrum version 2.x as it is without upgrading right now? 

No. It effects every version that existed as a server can do an rpc call if you don't have a password on your wallet.
You may as well upgrade, I've only ever used portable versions as they're easier to set up but there shouldn't need to be 12 words inputted every time as the data folders should be the same place, however, inputting the 12 words isn't really that much effort anyways and they're not too difficult to memorise once you've done it a few times.

[jerry0]

Well i do have a password on my electrum. 

But how many electrum users out there even know about this if they don't visit this forum.  What percentage of electrum users even visit this forum daily or check the electrum website for updates?

Well i have updated electrum few times when i had version 2.0 or 2.1 etc and then needed to upgrade to 2.2 etc.  But does anyone know when you do this when you download the new updated electrum on the website, do they ask you to type in the 12 word phrase?  I assume they have to right?  Because even though you still have old electrum wallet, it won't recognize it?  I updated electrum few times and i'm trying to remember if it ask me to type in the 12 word phrase as that option i already have a 12 word phrase etc.

Also someone mentioned this as well.  Is there a chance that this is a hack itself telling everyone to download the new electrum?  Thus the mod and/or site got hacked? 

I assume it would be fine to wait until the dust settles then?  Because i can't imagine even 10 percent of electrum users know about this since they need to either visit this forum or visit the electrum website daily to make sure there is an update.

[cryptoelusion]

I actually just installed Electrum for the first time yesterday, version 3.0.4, to use in conjunction with a Trezor. This doesn't sound like it would affect the keys on the Trezor device, but thought I'd ask here if that's a safe mindset.

I was actually in the process of sweeping some keys from another wallet to my Trezor wallet through the Electrum interface. Should I wait awhile before trying to do that given the vunerability?

[jtipt]

Let me get something straight.

I simply installed v 3.0.4 to overwrite current version
Is this appropriate??

Or do i have to completely uninstall the old version, and then reinstall the new v 3.0.4  and then do a restore of the wallet

Yeah I have the same question. And would updating to 3.0.4 enough to be safe enough, or are the previous private keys compromised? And I need to transfer my coin?