Electrum Bug or a common mistake from my end ??

[letteredhub]

I wanted to post this issue in the technical board where it fits most but had to bring it to the B&H for more exposure.

Am sharing an experience I had with my electrum wallet transaction from electrum to my bybit account, it's an experience that is really surprising to me because I have never had such issues in the years I have being using electrum wallet.

On the 13th August, 2026, I made a transaction of a little amount of BTC and as usual I went straight to my bybit account, copied the BTC address I have always being using, and then pasted it to my electrum wallet I was sending the BTC from, I confirmed it was the right address, and that was how I initiated the transaction.

I waited for hours I did not receive the BTC into my bybit account, so I had to check my wallet to know if the transaction has being confirmed or not, on checking I found it has not yet due to low fees and that was how I decided to bump the transaction by increasing the fees. After the rebroadcast of the transaction I waited for another hours again and still didn't get any notification from bybit account of a received transaction but it showing transaction confirmation on the electrum wallet which indicates that the funds has being sent. That was when I decided to track the transaction and I discovered it was received into a whole different Segwit BTC  address instead of the BTC native address I vividly copied from bybit  and even confirmed the address before.continuing the transaction in my electrum wallet.

Bybit don't make use of  Segwit BTC address so how could it be that on bumping the fees the coins was rather sent to an entirely new unknown address to me, and it actually the first transaction that the unknown address is receiving. Am dead sure I did not copy any address again while making the rebroadcast of the transaction,, so it can't be that it's a clipboard virus issue. And this isn't the first time am bumping my transaction fees and never had such experience with electrum wallet. What could have really caused such error?

Mind you: the first transaction which I sent that was delay due to low fee was directed to the Bybit address and it’s still very visible in the blockchain so it’s not a matter of the mistake being from the first time i authorized the transaction.
This is the transaction ID: df96f2f8158515924d7241d7ba4880357eb079e410fa547d40332a60fb6e1051

[Chibit01]

Mind you: the first transaction which I sent that was delay due to low fee was directed to the Bybit address and it’s still very visible in the blockchain so it’s not a matter of the mistake being from the first time i authorized the transaction.
This is the transaction ID: df96f2f8158515924d7241d7ba4880357eb079e410fa547d40332a60fb6e1051

This should be the right TX:
da225c8836e8c46e7ad99578f589225079ffd1ed7e01856f2753fb2fa94abf84

Which was your first transaction before it was replaced with the above.

I have been using electrum but such have not happened before, and this transaction was not even returned to your balance, or have you checked if the address did not belong to one of your unused address from electrum new generated address list?

[Cookdata]

so it can't be that it's a clipboard virus issue.

How can you to be so sure it's not a malware, beside you wouldn't know you have one on your PC until it happens to you.

Output can't change in a transaction if it wasn't modified. It's either the address belongs to part of your addresses or a malware must have done it. Check your PC and if that address is part of your wallet.

[letteredhub]

Mind you: the first transaction which I sent that was delay due to low fee was directed to the Bybit address and it’s still very visible in the blockchain so it’s not a matter of the mistake being from the first time i authorized the transaction.
This is the transaction ID: df96f2f8158515924d7241d7ba4880357eb079e410fa547d40332a60fb6e1051

This should be the right TX:
da225c8836e8c46e7ad99578f589225079ffd1ed7e01856f2753fb2fa94abf84

Which was your first transaction before it was replaced with the above.

Yes that's correct from the first transaction made.

I have been using electrum but such have not happened before, and this transaction was not even returned to your balance, or have you checked if the address did not belong to one of your unused address from electrum new generated address list?

Just as I said it's really surprising to me experiencing this with electrum wallet. I have for countless times checked my balance nothing has returned.

Unused address?! Am not sure. I have cross checked just now, and none is matching.

Output can't change in a transaction if it wasn't modified. It's either the address belongs to part of your addresses or a malware must have done it. Check your PC and if that address is part of your wallet.

I can't remember doing any modification except for bumping the fees to speeding the transaction. If it's a malware then am not sure it's from my end, my device is clean

[EL MOHA]

First thing I will advice is that you should check your change addresses from electrum change addresses and see if this particular address: bc1qanac40q6aslqcm6gycjqalg3k6nj9qrn0djpmw which Recieved the coin is actually included in your list of addresses.

Initial when you wanted to bump the fee, electrum a supposed to pick one of your UTXO to add to this transaction for extra fees but it seems that you don’t have extra UTXO to fund the new transaction so it deducted the fees from your original balance so what I don’t get is probably this was sent to your change address or there is definitely a malware on that device

 

Just as I said it's really surprising to me experiencing this with electrum wallet. I have for countless times checked my balance nothing has returned.

Unused address?! Am not sure. I have cross checked just now, and none is matching.

If you’re so sure then sorry there is a malware on that device

[Livingleged]

~snip

My take on this whole issue is it’s either someone has your keys and did the pumping to a different address or your device is being attacked by malware. Transactions cannot initiate it self to an unknown address if it wasn’t compromised. Check your PC to be sure your device isn’t infected because with your explanation it already seemed so.

[Hatchy]

Mind you: the first transaction which I sent that was delay due to low fee was directed to the Bybit address and it’s still very visible in the blockchain so it’s not a matter of the mistake being from the first time i authorized the transaction.
This is the transaction ID: df96f2f8158515924d7241d7ba4880357eb079e410fa547d40332a60fb6e1051

This isn't a bug. I checked the transaction, and it appears that when you initiated the fee bump, Electrum used one of your UTXOs to fund the transaction. That UTXO had a balance of about $48.48. When the transaction was bumped with the higher fee about $0.14 was used as the transaction fee, leaving approximately $48.34 as change. That change was sent back to a new change address belonging to your wallet.

[RGBTC]

Unused address?! Am not sure. I have cross checked just now, and none is matching.

Try increasing the gap limit e.g to 25 (the default is 20).https://electrum.readthedocs.io/en/latest/faq.html#gap-limit
Or re-import the wallet. This should allow Electrum to re-scan for all the "missing" Bitcoin balances. I haven't encountered a unique case like this before, but my reasoning suggests that one of these methods should resolve the issue, unless your Electrum installation is infected with malware.

Edit: Added a link to a tutorial on increasing the gap limit: https://bta.lk/t/5316980.msg56338770#msg56338770

[EL MOHA]

This isn't a bug. I checked the transaction, and it appears that when you initiated the fee bump, Electrum used one of your UTXOs to fund the transaction. That UTXO had a balance of about $48.48. When the transaction was bumped with the higher fee about $0.14 was used as the transaction fee, leaving approximately $48.34 as change. That change was sent back to a new change address belonging to your wallet.

This would have been it but it is not it, because even if an extra UTXO was added to the transaction to cover for the fees then the transaction details will have two inputs and then the output will be two also (bybit address and electrum change address).

But the transaction actually used same UTXO (0.0007718BTC) from the first transaction in the second transaction and deducted out the fees (0.0000022BTC) from that same UTXO and then replaced that transaction to another address which is not usually the right thing. If OP had even tried cancel the transaction it would have been understandable.

Either it was a mistake to a Change address or a malware on the device

[Cookdata]

Mind you: the first transaction which I sent that was delay due to low fee was directed to the Bybit address and it’s still very visible in the blockchain so it’s not a matter of the mistake being from the first time i authorized the transaction.
This is the transaction ID: df96f2f8158515924d7241d7ba4880357eb079e410fa547d40332a60fb6e1051

This isn't a bug. I checked the transaction, and it appears that when you initiated the fee bump, Electrum used one of your UTXOs to fund the transaction. That UTXO had a balance of about $48.48. When the transaction was bumped with the higher fee about $0.14 was used as the transaction fee, leaving approximately $48.34 as change. That change was sent back to a new change address belonging to your wallet.

I don't think so. Looking at his address, it gets funded from Rainbet's weekly signature, and in the last 2 months it has sent his payment to Bybit with this address: 19ovR1KtFmyfbKieNJToMrLYnz4vBVZFi8. However, the last replaced transaction was sent to a new address.



The transaction that was replaced spent the same 1 input that was received from his last payment to this address: bc1qanac40q6aslqcm6gycjqalg3k6nj9qrn0djpmw

This is the transaction summary of the replaced transaction. It has 1 input and 1 output, there is no additional input from anywhere.



If the output does not belong to OP, then it belongs to another malware actor.

[TypoTonic]

I wanted to post this issue in the technical board where it fits most but had to bring it to the B&H for more exposure.

Wouldn't it be better to post this in Wallet software > Electrum? There are other members who frequent there that might be able to give more input about this.
Edit: Seems like the thread was moved while I was writing this post.

I tried to search for related issues in their GitHub, where the destination address was changed after increasing the transaction fees, but I wasn't able to find any -- https://github.com/spesmilo/electrum/issues?q=is%3Aissue

If you know how the attack worked, you are welcome to tell the developers. It is useful for us to know about the type and number of attacks, to try to prevent or mitigate future attacks. If the stolen amount is substantial enough, consider reporting the theft to the police.

If you think what happened might have resulted from a bug (and not malware), we ask you open a bug report.

[YellowSwap]

Sounds like this Electrum wallet of yours is running on your PC? If that's yes then that's the problem, your PC is not who you think it was anymore, it's been compromised probably by malware.

I've never experienced this but go on Reddit you will see victims of this similar transaction missed, I have pc at home for internet browsing and other things and I know how big the catalog of malwares are when it comes to PC.

There is nothing, I repeat, there is nothing on this earth that can make me use a bitcoin wallet on my PC, it will never happen, if you are into how windows OS works you will know very well how big the risks you are taking is.

[Dreadboost]

I'm going to share the previous experience that I didn't share here when it happened. It is a similar case, but this time the wallet was the Bluewallet. I did a usual transaction, and upon poor internet connection, I have to re-click the confirm button. Waited for more than 2 hours, the transaction was confirmed without receiving the Bitcoin in my other wallet. The address the Bitcoin went to wasn't mine, and I haven't used it before. This could be the same scenario here. My conviction was that it was malware.

Sounds like this Electrum wallet of yours is running on your PC? If that's yes then that's the problem, your PC is not who you think it was anymore, it's been compromised probably by malware.

The transaction was made on a mobile device not on a PC, clearly from what the victim was saying. It could be a malware challenge

[suzanne5223]

Mind you: the first transaction which I sent that was delay due to low fee was directed to the Bybit address and it’s still very visible in the blockchain so it’s not a matter of the mistake being from the first time i authorized the transaction.
This is the transaction ID: df96f2f8158515924d7241d7ba4880357eb079e410fa547d40332a60fb6e1051

This isn't a bug. I checked the transaction, and it appears that when you initiated the fee bump, Electrum used one of your UTXOs to fund the transaction. That UTXO had a balance of about $48.48. When the transaction was bumped with the higher fee about $0.14 was used as the transaction fee, leaving approximately $48.34 as change. That change was sent back to a new change address belonging to your wallet.

I don't think so. Looking at his address, it gets funded from Rainbet's weekly signature, and in the last 2 months it has sent his payment to Bybit with this address: 19ovR1KtFmyfbKieNJToMrLYnz4vBVZFi8. However, the last replaced transaction was sent to a new address.



The transaction that was replaced spent the same 1 input that was received from his last payment to this address: bc1qanac40q6aslqcm6gycjqalg3k6nj9qrn0djpmw

This is the transaction summary of the replaced transaction. It has 1 input and 1 output, there is no additional input from anywhere.



If the output does not belong to OP, then it belongs to another malware actor.

Based on your findings here, it's either an Electrum bug that swaps the recipient address, which is extremely unlikely.
@letteredhub  Have you done anything to your Electrum wallet lately? Do you verify your Electrum wallet? Are you sure you have checked all your change addresses?
If that's not the issue, it means what you experience is malware (especially a clipboard or transaction hijacker) on your computer is the issue. How do you know your computer is clean?

[Cookdata]

There is nothing, I repeat, there is nothing on this earth that can make me use a bitcoin wallet on my PC, it will never happen, if you are into how windows OS works you will know very well how big the risks you are taking is.

PC are safe, the OS is the problem. Windows OS has plenty of malware because by users, it's has the highest number of users and it's closed source. I have used Windows pc with electrum installed and I have never had any problems.

I'm going to share the previous experience that I didn't share here when it happened. It is a similar case, but this time the wallet was the Bluewallet. I did a usual transaction, and upon poor internet connection, I have to re-click the confirm button. Waited for more than 2 hours, the transaction was confirmed without receiving the Bitcoin in my other wallet. The address the Bitcoin went to wasn't mine, and I haven't used it before. This could be the same scenario here. My conviction was that it was malware.

Was your transaction RBF enable and did you try to bump the fee? Yours is more strange because if you use Blue wallet to create a transaction, after you input the amount, the receiving address and the fee, there is a "Next" for you to confirm the details of your transaction. Did you check the address in the details before you click send or you didn't confirm this and you just send? Your case is likely clipboard malware, your device was infested with one.

Sounds like this Electrum wallet of yours is running on your PC? If that's yes then that's the problem, your PC is not who you think it was anymore, it's been compromised probably by malware.

The transaction was made on a mobile device not on a PC, clearly from what the victim was saying. It could be a malware challenge

I didn't see in the description where OP says he used phone. He just said he used electrum.

[Mia Chloe]

~snip

It's basically two things, either it's in a change address or it's a malware issue. Just to clarify if it was an actual malware issue, I'm guessing this current transaction hash you dropped is for the confirmed one ... If that is correct can you leave us the transaction id of the first broadcast?

Simply searching the old one will indicate on the mempool if it was replaced by another transaction or sent to a different address entirely that's not part of your change addresses.

[hosemary]

If that is correct can you leave us the transaction id of the first broadcast?

Chibit01 already posted the ID of the replaced transaction in the first reply, but mempool.space no longer has it, and the link he posted doesn't show the transaction.
Instead, you can use blockchain.com to view the replaced transaction.

Simply searching the old one will indicate on the mempool if it was replaced by another transaction or sent to a different address entirely that's not part of your change addresses.

Cookdata already posted the receiving address of the first transaction in this post.
The original transaction sent the funds to 19ovR1KtFmyfbKieNJToMrLYnz4vBVZFi8, and it was replaced by another transaction that sent the funds to bc1qanac40q6aslqcm6gycjqalg3k6nj9qrn0djpmw.

[nc50lc]

-snip- I have for countless times checked my balance nothing has returned.

This case is complicated because there's no definite way to reproduce it, no enabled logs to check the inner workings and you saw the address after the bump not during it.

Anyways, what does the transaction's output looks like when you open it from your history tab?
Is the output address highlighted?

I'm thinking that you might have accidentally clicked "Cancel (replace-by-fee)" instead of "increase fee" since those two options are close to each other;
And the window that'll open is strikingly similar except for the title bar.

The missing balance is another issue if it's the case, bug in the cancel feature or something related...

Plus, we can't deduct the possibility of your private keys or seed being compromised since you wont notice the transaction being replaced after a version broadcasted by the attacker made it in the server that your connected to.

Anyways, more information like Electrum version, how the secrets are stored or even screenshots would be great.

[letteredhub]

-snip- I have for countless times checked my balance nothing has returned.

This case is complicated because there's no definite way to reproduce it, no enabled logs to check the inner workings and you saw the address after the bump not during it.

Anyways, what does the transaction's output looks like when you open it from your history tab?
Is the output address highlighted?

This the output address that I later saw after bumping the fees.

I'm thinking that you might have accidentally clicked "Cancel (replace-by-fee)" instead of "increase fee" since those two options are close to each other;
And the window that'll open is strikingly similar except for the title bar.

The missing balance is another issue if it's the case, bug in the cancel feature or something related...

Let assume this to be what may have occurred in the process of me trying to bump up the fees. This address where the funds was rather sent to, where did it emanated from is what am yet to understand.

Plus, we can't deduct the possibility of your private keys or seed being compromised since you wont notice the transaction being replaced after a version broadcasted by the attacker made it in the server that your connected to.

Anyways, more information like Electrum version, how the secrets are stored or even screenshots would be great.

I don't think my wallet seeds has being compromised neither my server and, it doesn't seem to be from there because an attacker using my seed phrase wouldn't wait till when am about to make transaction before he/she decides to get into the process to replace my transaction to hijack funds.

A photo view of the electrum wallet version.

[hosemary]

This the output address that I later saw after bumping the fees.

The receiving address in your screenshot is shown in yellow, which means that it's yours.
So, nc50lc's guess was right. You cancelled the transaction mistakenly, and the funds were sent to one of your change addresses.

This address where the funds was rather sent to, where did it emanated from is what am yet to understand.

Tap on your wallet name and select "Addresses/Coins". You should see that address among your change addresses.