Electrum 4.8.3. This release fixes a critical security issue

[ryzaadit]

Once I saw this issue. I always think of the tragedy involving one of our local members who lost 1.2 BTC in this thread: [TANYA] Lacak BTC yang dicuri in September.

Short story, based on his explanation:

sampe sekarang masih belum ketawan dari mana malwarenya berasal (tapi kemungkinan besar dari app electrumnya yg dicompromise). jadi sebelumnya di electrum addressnya bener address saya, tapi txnya pending locally gitu. pas fee ditambahin addressnya kereplace sama address scammer, sama persis seperti kasus dibawah ini
https://www.reddit.com/r/Electrum/comments/1ccrfop/transaction_replaced_to_scammer_wallet/

dan wallet ini udah bertahun2 juga di mac ini dan gapernah ada issue, bisa om om semua liat kalau sudah ada 10k tx dan biasanya aman aja. dan kalau masalah kenapa gak dicek addressnya pas replace, saya lagi mabuk dan dah gak sabar mau split ace di stake bj duitnya kurang.

To this day, it’s still unclear where the malware originated (though it’s highly likely that the Electrum app itself was compromised). Previously, the address shown in Electrum was indeed my own, but the transaction remained in a "pending" state locally. When I increased the fee, the address was replaced with a scammer’s address—exactly like the case described here:
https://www.reddit.com/r/Electrum/comments/1ccrfop/transaction_replaced_to_scammer_wallet/

I’ve been using this wallet on my Mac for years without any issues; as you can see, there are 10,000 past transactions, and everything had always been fine. As for why I didn’t check the address when it was replaced—well, I was intoxicated and impatient to split a pair of aces in a game of blackjack, but I didn't have enough funds.

I thought, at the time these case being opened by him. I and our other local member think this because a Clipboard Hijacked. So, we and others decided to advise him to maybe test some transactions or check his device..

Feels bad for him.

[Wind_FURY]

Once I saw this issue. I always think of the tragedy involving one of our local members who lost 1.2 BTC in this thread: [TANYA] Lacak BTC yang dicuri in September.

Short story, based on his explanation:

sampe sekarang masih belum ketawan dari mana malwarenya berasal (tapi kemungkinan besar dari app electrumnya yg dicompromise). jadi sebelumnya di electrum addressnya bener address saya, tapi txnya pending locally gitu. pas fee ditambahin addressnya kereplace sama address scammer, sama persis seperti kasus dibawah ini
https://www.reddit.com/r/Electrum/comments/1ccrfop/transaction_replaced_to_scammer_wallet/

dan wallet ini udah bertahun2 juga di mac ini dan gapernah ada issue, bisa om om semua liat kalau sudah ada 10k tx dan biasanya aman aja. dan kalau masalah kenapa gak dicek addressnya pas replace, saya lagi mabuk dan dah gak sabar mau split ace di stake bj duitnya kurang.

To this day, it’s still unclear where the malware originated (though it’s highly likely that the Electrum app itself was compromised). Previously, the address shown in Electrum was indeed my own, but the transaction remained in a "pending" state locally. When I increased the fee, the address was replaced with a scammer’s address—exactly like the case described here:
https://www.reddit.com/r/Electrum/comments/1ccrfop/transaction_replaced_to_scammer_wallet/

I’ve been using this wallet on my Mac for years without any issues; as you can see, there are 10,000 past transactions, and everything had always been fine. As for why I didn’t check the address when it was replaced—well, I was intoxicated and impatient to split a pair of aces in a game of blackjack, but I didn't have enough funds.

I thought, at the time these case being opened by him. I and our other local member think this because a Clipboard Hijacked. So, we and others decided to advise him to maybe test some transactions or check his device..

Feels bad for him.

Is that person's issue connected with OP's PSA? That person also posted that Electrum may have been compromised. 👀

Was there any proof confirming that that person is right, or is he merely saying things according to his own theory/opinion?

[OgNasty]

Is that person's issue connected with OP's PSA? That person also posted that Electrum may have been compromised. 👀

Was there any proof confirming that that person is right, or is he merely saying things according to his own theory/opinion?

It looks to be an exact match of the issue being reported.  My understanding is that to be compromised it required the user to resubmit a transaction with a higher fee.  That is exactly what the compromised user explained happened.  The scary thing is how long it took for this to be realized and patched.  Anyone who sent BTC using this wallet over the last month or so was in danger of having their funds stolen.  I'm sure there are more victims.  This is still a popular wallet to use right?  I guess we are lucky this happened during a slow period in BTC, otherwise there could have been a lot more victims.  I also wish this issue was getting more attention as there are certainly users on this forum still using the compromised software.

[ryzaadit]

Was there any proof confirming that that person is right, or is he merely saying things according to his own theory/opinion?

Before the critical security is shared by ELECTRUM, those posts are just speculation from him. Then, this critical security came out and made those suspicions seem correct.


Yesterday he made a post.
He hired a forensic expert to check his device to make sure the device does not contain any malware, and found none. Right now, he is already letting go of the incident and feeling no guilt at all because this tragedy is not 100% due to his mistake or his device.

But still feel bad for him.

[Wind_FURY]

OK, then what are the more modern wallets should I use with my Trezor as my main hardware wallet? After this vulnerability, I believe it's time to move on from Electrum and use something else.

It's not that I don't trust Thomas Voegtlin, and the other contributors, but it's simply a choice. I currently feel safer using Trezor Suite. Am I wrong?

[nc50lc]

What about the Trezor Suite? Do you believe that we should trust that they're not affected with that bug? There have been no announcement from their X account, nor from their blog. The app doesn't have the upgrade notification on as well.

Trezor Suite isn't affected even though it uses the same SPV method as Electrum because it doesn't connect to random public servers unless the user specifically set it.
It defaults to their own proprietary server.

It's not that I don't trust Thomas Voegtlin, and the other contributors, but it's simply a choice. I currently feel safer using Trezor Suite. Am I wrong?

Fair enough.

The issue requires the user to neglect the simple verification if the replacement transaction's outputs match with the original,
But we can't expect every end-user to do so.