Electrum 4.8.3 patches fake payment swap by malicious servers

Electrum released version 4.8.3 on October 24 to fix a flaw where a malicious server replaced a user's payment with a fake zero-fee transaction paying the attacker, which then got signed during fee-bumping. The patch verifies cryptographic signatures on wallet-owned inputs before adding unconfirmed transactions to history.

• Attack seen in the wild: report on October 11, confirmed loss on October 18
• Fake zero-fee transaction looks stuck and lures users into replace-by-fee
• Server can regenerate addresses until the tail matches the real recipient
• Fix does not cover incoming payments from third parties