Bitcoin wallet Electrum released version 4.8.3 on October 24 to patch a high-severity flaw that let malicious servers inject fake transactions and trick users into paying attacker addresses; all versions before 4.8.3 are affected. Attackers can grind the fake transaction's output address to match the last four characters of the intended destination, so anyone checking only the tail of a long address could see an apparent match. At least one user confirmed losing funds on October 18 after fee-bumping a manipulated transaction, while a separate report on October 11 caused no loss because the transaction never spread beyond the local server. The patch verifies signatures on wallet-owned inputs before showing unconfirmed transactions, but incoming transactions from external senders still lack signature verification, a gap the developer acknowledged needs more work. Users who connect only to servers they run themselves are not affected, and those who cannot update should carefully check addresses and amounts before signing.
Summary written by Upside AI from the original article. Read the source for full details.
Read the original on Decrypt ↗
Keywords
Open a keyword to see other news on the same topic.
Related tickers and likely impact
BTC/USDT
• NeutralBitcoin
Relevance: low
| Market | Crypto |
|---|---|
| Exchange | Binance |
| Sector | Layer 1 |
| Market cap | $1.6T |
| Close on 10/25/2026 | 80,154.09 |
| Change that session | -0.91% |
Impact is scored by AI from the headline and may be wrong. It is not investment advice.
Related news
- Bitcoin wallet bug let rogue servers steal funds when users tried to speed up payments
A flaw in Electrum, one of Bitcoin's oldest software wallets, let malicious servers replace pending transactions with fake ones that users could unknowingly approve when using Replace-by-Fee to raise fees. Because the wallet did not check signatures on unconfirmed transactions, it could sign a valid replacement sending coins to the attacker, and at least one user lost bitcoin after raising the fee. Developers received reports on Oct. 11 and Oct. 18, and released version 4.8.3 on Oct. 24 to add signature checks, six days after the first reported theft. Earlier versions remain vulnerable when connected to malicious servers, and the amount stolen has not been disclosed. Users should upgrade and verify addresses and amounts before signing; those using only trusted servers, including their own, were not exposed.
- AI agents help rescue ETH’s Glamsterdam fork, ‘Steal My Bitcoin’ site: Hodler’s Digest
The second and final testnet for Ethereum’s Glamsterdam hard fork was cancelled after ChainSecurity found vulnerabilities in two gas-scaling proposals (EIP-8037/8038) that could have affected at least 13 DeFi contracts. Derek Chiang of Eth Labs said the flaw was found only a few minutes before midnight, forcing everyone to scramble, and the Hoodi dress rehearsal will not be rescheduled until the second-order effects are fully analysed. To speed up the review, researchers from Eth Labs and the Ethereum Foundation deployed AI agents that coordinated through a message board in a GitHub repo, and a second board now examines EIP-8198 (“Quick Slots”) for the proposed Hegota fork. Separately, the ‘Steal My Bitcoin’ site, which has not been patched against the PHP2Shell vulnerabilities, holds the key to a Bitcoin wallet worth around $2000 and had gone 25 hours without a successful hack at the time of writing.
- Bitcoin Core Rewrites Its Security Policy for a World Where AI Finds Bugs in One Prompt
Bitcoin Core has updated its security policy so that bugs that are easily discoverable will be patched quickly rather than kept under a long embargo. The project will backport fixes to all maintained releases, ship a new version as fast as possible, and publish an advisory, since large language models have greatly lowered the effort needed to find such flaws and a quiet patch would accomplish little. The change was proposed by Chaincode Labs developer Antoine Poinsot and merged on Thursday. The article links the shift to AI-driven bug discovery, noting that an AI-driven audit logged nearly 5,000 findings across hundreds of crypto projects in early August, and that developers have patched AI-surfaced bugs in Lightning implementations and hardware wallets, while one Bitcoin bridge shut down.
- Bitcoin Core changes security rules as AI makes finding code bugs dangerously easy
Bitcoin Core has changed its security policy so that vulnerabilities an AI model could rediscover with a simple prompt will be quickly disclosed and patched, replacing embargoes that could last about a year. According to developer Antoine Poinsot, reports of easily rediscovered flaws rose as LLMs lowered the bar for finding certain bugs, though fixes may get less testing before reaching users. A volunteer group of 16 developers ran AI models across 390 bitcoin projects in about a day in late July, logging 4,962 findings, 85 of them critical. Separately, a Coldcard hardware-wallet firmware flaw dormant since 2021 let attackers drain 594 BTC in 25 minutes on July 30, with losses nearing $114 million across four sweeps.
- Bitcoin Core changes security policy as AI makes bugs easier to find
Bitcoin Core is changing its security disclosure policy because large language models have made some flaws easy to rediscover, so long embargoes offer little protection. Under the new policy, vulnerabilities deemed easily discoverable will be fixed as soon as possible across all maintained major versions, with security advisories published alongside the updates. Other flaws will follow severity-based schedules: low-severity bugs will be disclosed two weeks after the fix is released, while medium and high-severity bugs will be disclosed two weeks after the last affected release reaches End of Life, typically a year after the fix. The change follows a volunteer Bitcoin Red Team report of nearly 5,000 potential issues across 390 projects in August, though only about a fifth had been reproduced at that point.
- Crypto Firms Launch Quantum Alliance as 6 Million Bitcoin Sit Exposed
Nine blockchain organizations launched the Quantum Alliance, an open standards body that will define “quantum-ready” and set common ways to test quantum-resistance claims. The group warns that roughly 6.04 million BTC, about 30% of supply, is quantum-exposed because of elliptic-curve signatures, with forecasts pointing toward the late 2020s. A Google Quantum AI study cut the qubits needed to break Bitcoin’s cryptography to under 500,000, though no machine can do it yet. Modeled on the IETF, the Alliance will work in four groups covering migration, zero-knowledge systems, wallet security and cross-chain compatibility. Separately, a consortium backed by BlackRock, Strategy and Coinbase has committed $15 million to the problem.
Related markets
Latest news
- FTC and 20 states sue Dollar General, alleging retailer overcharged shoppers
The Federal Trade Commission and 20 states sued Dollar General, accusing it of charging customers more than the prices displayed on shelves, price tags and in advertisements. The complaint says thousands of stores extracted millions of dollars in unlawful overcharges and that the company received “tens of thousands” of consumer complaints without adopting policies to fix the problem. Dollar General shares fell about 4% after the announcement, and the company did not immediately respond to a request for comment. The suit comes as shoppers look for discounts amid elevated food and gas prices, ahead of next week’s midterm election.
- Is the Buffett Indicator Flashing a Warning Sign to Stock Market Investors?
The Buffett indicator, which divides the total value of U.S. stocks by GDP, stands at 234%, near its record high and well above the roughly 135% reached during the dot-com bubble. The CAPE ratio is 40.6, higher only in the dot-com period, while the S&P 500 has grown at an annualized pace of roughly 15% over the past 10 years, versus a historical average of 10%. The author argues the indicator ignores overseas revenue of large U.S. companies and the rapid expansion of liquidity, with M2 rising from $6.9 trillion to $23.3 trillion, so he does not see it as a clear warning sign. The author also says investors should not use it as a tool to time the market, since the S&P 500 has posted gains over every rolling 20-year period.
- Rockefeller Adds J.P. Morgan Team in Houston
Rockefeller Capital Management has added a seven-member Houston team from J.P. Morgan to its Global Family Office division, led by managing directors Chris Sheets and Forrest Green. According to a Forbes Best-in-State advisor ranking, the team previously managed $1.4 billion in assets and had been with Bernstein Private Wealth Management before joining J.P. Morgan in 2018. The move follows Rockefeller’s earlier-this-month addition of The Kellam Group, a Naples, Fla.-based team from Truist. Rockefeller oversees about $237 billion in client assets.
- Shopify “Has Not Grown Into Its Multiple at All” as Investors Pay 112 Times Profits
Shopify shares rose 33% in a month following Meta’s Muse deal, before ATB Cormark downgraded the stock to Sector Perform. On the We Study Billionaires podcast, Daniel Mahncke argued the rally came mainly from earnings roughly doubling, while the premium investors pay stayed at about 112x operating profits. Normalized EPS rose from $0.73 in 2023 to $1.43 in 2025, and the forward P/E of 80x is close to its 3-year average of 74x. Operating margin climbed from 3.7% to 16.4%, but subscription gross margin fell to 79.7% as cloud and AI costs rose $37 million. The article says the valuation depends on AI shopping agents keeping growth strong, with third-quarter results as the first test.
- Tokenized Stock Trading Has Been a Big Hit Overseas. So Why Are Some Publicly Traded Companies in America Objecting?
Robinhood has launched tokenized stock trading in over 120 countries this year but has not yet received U.S. approval. Tokenized stocks are blockchain tokens representing ownership of conventional shares that can be traded 24/7 across borders, yet holders lack voting rights and direct cash dividends because a custodian bank holds the underlying shares. Microsoft, Verizon and McDonald’s are among a growing list of large companies that have filed to bar tokenization of their shares, arguing platforms cannot issue synthetic versions without consent and that the practice compromises investor safety and corporate governance. In September, the SEC issued an “innovation exemption” letting qualifying platforms trade tokenized stocks in the U.S. for up to five years, but it requires equal rights for holders and gives companies 30 days to object. The article suggests Robinhood is unlikely to bring the feature to U.S. investors soon given nearly two dozen major objectors, though its overseas growth remains worth watching.
- Geopolitical tensions complicate the gold bull case, says AHG president
Max Baecker, president of American Hartford Gold, says Middle East tensions are complicating the gold outlook, even as central bank buying supports demand. He argues higher energy prices could fuel inflation and tighter monetary policy expectations, strengthening the dollar and weighing on gold, which is why gold does not always rise during a geopolitical crisis. He notes central bank buying has roughly doubled from its pre-2022 average, and the People's Bank of China has increased its gold reserves for 23 consecutive months, with Chinese net gold imports reportedly reaching 316 tonnes in the first quarter. In the near term, he says the Fed sets the pace of gold's moves rather than its direction.
Get the briefing on Telegram or Zalo
Join the Upside Telegram channel or Zalo group for the Vietnam stocks and gold briefing at 8:00 and 19:00 (Vietnam time) on trading days, plus a weekly wrap on Saturday morning.