Understanding Bitcoin’s Replace-by-Fee Vulnerability in Electrum Wallets

Bitcoin’s Replace-by-Fee (RBF) feature allows users to replace unconfirmed transactions with new ones that carry higher fees. While this can be useful for expediting transactions, it has also been exploited in recent attacks targeted at Electrum wallet users.

How the Exploit Works

In instances of fraudulent activity, attackers can take advantage of the RBF feature by generating a transaction without any fee, causing it to appear as if it is stuck. Additionally, these attackers create receiving addresses that closely resemble those of legitimate destinations, complicating the identification of fraudulent transactions.

Incident Reports

Case 1: Multisignature Wallet Exploit

The first reported incident, dated October 11, involved a wallet configured using a two-of-three multisignature setup with two Trezor hardware devices. Although the user verified the legitimate transaction on both devices, they later noticed a suspicious outgoing transaction recorded in the wallet history. Fortunately, this user did not report any loss of funds.

Case 2: Loss Due to Fee Modification

A second user reported on October 18 that they attempted to increase the fee on a replaced transaction, resulting in a financial loss. The developers of Electrum have not disclosed the specific amounts lost or the details of the malicious servers involved in these incidents.

Electrum’s Response

In response to these vulnerabilities, Electrum released an updated version, 4.8.3, on October 24. This update introduced signature checks for unconfirmed transactions that utilize coins from the user’s own wallet. Despite this enhancement, earlier versions of Electrum remain susceptible to similar attacks when connected to compromised servers.

Recommendations for Users

To mitigate the risk of falling victim to such attacks, users are strongly encouraged to:

• Upgrade to the latest version of Electrum.
• Carefully verify receiving addresses and transaction amounts prior to signing any payments.
• Connect only to trusted servers, including personal servers, to ensure higher security.

By adhering to these practices, users can better protect their digital assets against potential threats in the ever-evolving landscape of cryptocurrency transactions.