As CoinDesk reported Monday (Oct. 26), Electrum revealed this vulnerability over the weekend, saying some servers had begun exploiting it.
Developers had gotten two reports this month, including one from a user who lost money after approving what seemed to be a typical transaction fee increase, Coindesk said.
Electrum, unlike a full bitcoin node, uses outside servers to retrieve transaction histories and broadcast payments, the report said. Prior to the fix, the wallet trusted those servers to inform it of pending transactions but did not verify their signatures.
We’d love to be your preferred source for news.
Please add us to your preferred sources list so our news, data and interviews show up in your feed. Thanks!
That meant an attacker controlling one of the servers could capture a payment before it reached the bitcoin network and swap it out in the wallet’s history with a phony transaction. However, the wallet showed the phony payment as pending, with users falling into the cybercriminals’ trap when they tried to speed that transaction, the report said.
Bitcoin offers a feature called Replace-by-Fee, which permits unconfirmed transactions to be replaced with versions with higher fees. If a user chose that option, Electrum could take the fraudulent transaction and approve a valid replacement, sending the funds to the attacker.
Electrum has since issued an update that includes signature checks for unconfirmed transactions that use coins from the customer’s own wallet, the CoinDesk report said.
But earlier versions are still vulnerable to the attack when connected to malicious servers, the report said, adding that Electrum’s developers suggest upgrading and checking receiving addresses and amounts prior to signing off on payments.
News of the attack on Electrum’s wallet comes on the heels of similar incidents involving crypto wallets. Earlier this month, cryptocurrency hardware wallet company Ledger said it was investigating a hack that siphoned away $90 million from its devices.
It was the latest in a string of attacks on “cold wallets,” which store private keys but are not connected to the internet. They were once thought to be off-limits from criminals, but a software flaw in similar devices from Coinkite this summer revealed their vulnerability.
“The incident did not break bitcoin’s encryption or reverse transactions on its blockchain. It wasn’t a wrench attack where attackers stole a physical device, tricked its owner into revealing a password or installed malware on an internet-connected computer,” PYMNTS wrote in August on the Coinkite hack. “Instead, the failure occurred at the point of a supposedly secure device.”
Add as Preferred Source
