Electrum Bug Lets Hackers Drain Wallets
A critical flaw in the Electrum bitcoin wallet software left users vulnerable to theft when attempting to speed up their payments.
The vulnerability came to light after two reports in October: one on October 11 involving a two-of-three multisignature wallet using two Trezor hardware devices (with no funds lost), and another on October 18, where a user lost money after increasing the transaction fee on a substituted transaction. Notably, both victims observed that the thief’s address ended with the same four characters as their intended recipient, making detection even more difficult.
Electrum’s reliance on outside servers for transaction histories and payment broadcasting meant that any user connecting to an untrusted server was at risk. The fix arrived with version 4.8.3, which added signature verification for unconfirmed outgoing transactions—a safeguard absent in earlier releases.
Keystone Leak Puts User Addresses at Risk
Keystone, a hardware wallet manufacturer, disclosed a breach of its website that exposed sensitive customer shipping information earlier this week. The company confirmed on Friday that names, contact details, order information, and addresses were accessed by an unauthorized party after suspicious API activity was detected and reviewed with Shopify.
Despite Keystone’s claim of deleting customer data after 180 days—a policy stated in a 2023 blog post—some customers who purchased devices over two years ago reported receiving breach notifications.
The number of affected customers remains undisclosed. However, the incident highlights how even privacy-minded hardware wallet makers can fall short of their own promises regarding data retention and deletion. This tension between stated policy and actual practice is causing anxiety among users who believed their information had long been erased.
See Also
Malicious Servers Target Electrum Transactions
The Electrum bug was actively exploited in the wild before the fix was released. Attackers leveraged the wallet’s dependence on external servers by inserting fraudulent transactions into users’ histories and then prompting them to “bump” transaction fees—a process intended to speed up stuck payments but which, in this case, redirected funds to attacker-controlled addresses using invalid signatures.
According to coindesk.com, at least one user lost money due to this attack after attempting to raise the fee on a substituted transaction on October 18.
Keystone’s Shopify Flaw Raises Privacy Fears
Keystone’s breach underscores how third-party integrations can introduce vulnerabilities into hardware wallet ecosystems. The company identified Shopify API activity as the vector for unauthorized access and has since blocked it while launching an investigation and notifying affected customers by email.
Blockchain security firm CertiK recorded 52 verified wrench attacks—physical attempts to coerce crypto holders—worldwide in just the first half of 2026 alone, up from 39 during the same period in 2025. As more personal data is exposed through breaches like Keystone’s, concerns grow that attackers could use leaked addresses or contact details for targeted threats offline as well as online.
Outdated Electrum Versions Remain Exposed
While version 4.8.3 closes the door on this specific Electrum exploit, users running older software are still at risk if they connect to untrusted servers. Only those who exclusively use trusted or self-hosted servers are protected from this vulnerability; everyone else should upgrade immediately or risk further incidents.
The fix arrived swiftly after public disclosure on October 24, but uncertainty lingers for those slow to update or unaware of the threat.
Fixes Arrive, But Questions Persist
Both Electrum and Keystone have moved quickly to address their respective incidents—Electrum with new binaries released on October 24 and Keystone with remedial actions following last week’s discovery—but questions remain about how many users were ultimately impacted and whether all exposed data has truly been secured or deleted.
This year’s surge in physical attacks targeting crypto owners adds further urgency for robust digital and real-world safeguards around hardware wallets—especially as breaches reveal gaps between stated privacy policies and actual practices.
What remains in focus
Electrum users must update to version 4.8.3, released on Oct. 24, as all earlier versions remain vulnerable to theft if connected to malicious servers; if users fail to upgrade or continue using untrusted servers, immediate risk of fund loss persists.
