The Importance of Using a Private Server in Electrum Wallet

[AakZaki]

On September 1st, a friend from my local Indonesia, admitted that he had lost his Bitcoin as much as 1.21246839 BTC, but after he found the explanation in this link https://github.com/spesmilo/electrum/security/advisories/GHSA-6jp4-8v48-cc5v he realized that it was caused by the Electrum Server, because the incident was exactly the same as described in the link.

In addition, he also showed another link that also explained a similar case to him that occurred 3 years ago here https://www.reddit.com/r/Electrum/comments/1ccrfop/transaction_replaced_to_scammer_wallet/

And currently I read another similar case that happened on October 28 yesterday, which resulted in the loss of 0.87492841 BTC here https://www.reddit.com/r/Bitcoin/comments/1xjfa5i/lost_70k_usd_085btc_due_to_electrum_rbf_security/

After an incident like the case above, there is actually no longer a reason to use the Electrum Public Server randomly, because in the Electrum Wallet there are a lot of Public Servers that we don't even recognize or even one of them is a Malicious Server that we are not aware of.


I think the most sensible solution right now is to use a Private Server and Electrum Wallet running on Linux, but this setup is quite complex and requires large resources such as storage space. But what does all that mean, for the sake of the security of our assets.

[Zaguru12]

I think this particular is very much related to the reason for this new electrum update as it was explained on this thread: Electrum 4.8.3. This release fixes a critical security issue it’s an RBF related problem although it has been fixed but it’s best to take caution first is to always verify the recipient address when carrying out RBF or before bumping any transaction one should also check the TXID using any block explorer to actually verify if the transaction was actually propagated by the connected node because usually such transactions are not propagated and on the block explorer it will show in invalid transaction.

Although the best option still remains running your own server but if it’s complex I think one of the best resolution will be maybe one should start connecting to servers of reputable members here it is much better to connecting to just any random server

[BitMaxz]

Most of the Electrum servers nowadays are IPs; it's too risky to connect to any of these. That is why I only do it manually and connect to a well-known one, and another layer of my protection against them only uses them for the watch, not the wallet. Meaning my real wallet never reaches the internet, and I only use them to monitor my wallet and create unsigned transactions and broadcast my transaction manually to mempool.space and sometimes to ViaBTC.

Like the above, if it was the same issue as the previous post here on the forum related to a critical issue on a few Electrum servers, those who had cold storage wallets won't easily be infected from those online attacks. That is why having two separate devices is a must; at least the watch-only wallet is the one that will suffer from any attacks that come from other sources online. Your offline wallet is completely protected from these attacks.

[pooya87]

I think the most sensible solution right now is to use a Private Server and Electrum Wallet running on Linux, but this setup is quite complex and requires large resources such as storage space. But what does all that mean, for the sake of the security of our assets.

The only problem with this solution is that majority of people who choose a light wallet cannot or do not want to run a full node, so I doubt if they could spend money to run a full node on a remote server just so that they could connect their local light wallet to it.

But if anybody can do it then the best solution is to run their own full node locally (on their own machine) if they want maximum security and privacy.

[nc50lc]

In addition, he also showed another link that also explained a similar case to him that occurred 3 years ago here https://www.reddit.com/r/Electrum/comments/1ccrfop/transaction_replaced_to_scammer_wallet/

Holy cow, that's 3 years ago and it's surprising that it's never been found until recently when one user reported his case.
There're probably more undocumented or mislead cases since the issue had been there ever since opt-in-rbf is implemented in Electrum.

One reason of its elusiveness was probably,
most tech savvy users tend to use their own Electrum server or haven't set to randomize their server selection method.
Regular joe victims are most probably brushed off to thinking that they're just hacked or it's a clipboard hijacking virus/malware.