In release notes published on 2026-10-23, Electrum said version 4.8.3 contains a security fix for a malicious-server attack that could replace a newly broadcast transaction and attempt to trick a user into initiating a Replace-by-Fee action. The immediate question for users is whether they were running an older wallet version when attempting to speed up a pending outgoing payment.

What Electrum 4.8.3 officially fixed

Electrum’s GitHub release notes identify version 4.8.3 as a security update and describe the threat specifically: “Malicious server can replace a just-broadcast tx and try to trick user into RBF-ing it.” This is the clearest official description of the issue and is more precise than a broad characterization such as payment redirection.

In practical terms, the release-note wording indicates an attack against a transaction that had already been sent but had not yet confirmed. The risk was not simply sending Bitcoin through Electrum; it was being prompted to create a replacement transaction after the original payment had already been broadcast.

Why the attack worked on pending transactions

Electrum’s documentation states that the wallet trusts the server for information on unconfirmed transactions, while confirmed transactions are verified through SPV. This documented trust boundary helps explain why a malicious server could affect a payment before the original transaction was confirmed.

The same documentation says Electrum normally maintains connections to around 10 servers and chooses one as its main server. That does not mean every server connection poses the same risk in every workflow, but it illustrates why server-provided information about a pending payment can influence what the wallet shows the user before confirmation.

Which users should check exposure now

The main group reported as needing review is users of versions before 4.8.3 who had an unconfirmed outgoing transaction and then attempted to increase its fee. The affected-version detail and reports of real-world incidents came from crypto.news, rather than the Electrum release note reviewed here, and should therefore be treated as current reporting rather than official language defining the affected version range.

The immediate checks are straightforward. First, confirm that your wallet is running version 4.8.3 or later. Second, review any recent outgoing Bitcoin payment that was still pending when you tried to accelerate it with Replace-by-Fee. Before approving any replacement transaction, compare the full destination address and amount. This is the most practical self-check supported by Electrum’s official description of the attack path and its documentation on unconfirmed transactions.

crypto.news also reported that downloadable 4.8.3 binaries became available on 2026-10-24, after the 2026-10-23 release-note entry. That helps explain the trigger for public reporting, but it is distinct from Electrum’s officially reviewed release-note date.