{"id":14930,"date":"2026-10-26T09:50:48","date_gmt":"2026-10-26T09:50:48","guid":{"rendered":"https:\/\/cryptonews.uk.com\/?p=14930"},"modified":"2026-10-26T09:50:48","modified_gmt":"2026-10-26T09:50:48","slug":"hackers-found-a-way-to-steal-bitcoin-without-private-keys","status":"publish","type":"post","link":"https:\/\/cryptonews.uk.com\/?p=14930","title":{"rendered":"Hackers found a way to steal Bitcoin without private keys"},"content":{"rendered":"<p><\/p>\n<div data-cs-editorial-figure-scope=\"\" data-cs-editorial-quote-scope=\"\" data-cs-image-viewer-scope=\"\" data-single-article-content=\"\">\n<p>Bitcoin wallet Electrum has patched a security flaw that allowed hackers to redirect payments when users tried to increase transaction fees.<\/p>\n<p>The developers disclosed the vulnerability on Oct. 24, confirming that malicious servers had exploited the weakness and that at least one user lost Bitcoin after unknowingly approving a fraudulent transaction.<\/p>\n<p>The high-severity vulnerability affects Electrum versions earlier than 4.8.3. It exploits the wallet&#8217;s reliance on external servers to track unconfirmed transactions, allowing attackers to manipulate the payment information users see before they authorize additional fees.<\/p>\n<p>The disclosure followed two complaints received on Oct. 11 and Oct. 18. The first user noticed an unfamiliar transaction appearing in their wallet after broadcasting a payment, while the second reported losing funds after attempting to accelerate a pending transfer.<\/p>\n<p>Both incidents involved attackers generating Bitcoin addresses that matched the final four characters of the intended recipients&#8217; addresses, potentially deceiving users who relied on partial address checks.<\/p>\n<div class=\"cs-article-embed\">\n<p> <span class=\"cs-article-embed__related-reading\">Related Reading<\/span><\/p>\n<h3 class=\"cs-article-embed__title\">Eclair merges fixes for Lightning flaws that could burn Bitcoin in fees<\/h3>\n<\/p>\n<p> <span class=\"cs-article-embed__arrow\" aria-hidden=\"true\"> <i class=\"fa-light fa-arrow-up-right\"\/> <\/span> <\/div>\n<p>Electrum did not disclose the amount stolen, although its maintainers confirmed that some servers were actively carrying out the attack.<\/p>\n<h2>How hackers turned Bitcoin fee adjustments into unauthorized payments<\/h2>\n<p>The exploit takes advantage of a weakness in how Electrum processes transaction information supplied by its connected servers.<\/p>\n<p>When a user broadcasts a Bitcoin payment, a malicious server can withhold the transaction from the network and instead supply a conflicting version that redirects the funds to an attacker-controlled address.<\/p>\n<p>The fraudulent transaction initially contains invalid signatures, meaning it cannot be processed as a legitimate payment. However, affected Electrum clients failed to verify those signatures before displaying the substituted transaction in the wallet&#8217;s unconfirmed history.<\/p>\n<aside id=\"cs-inline-newsletter-1\" class=\"cs-inline-newsletter cs-newsletter-brand\" data-newsletter-edition=\"catalyst\" data-inline-newsletter=\"\" data-newsletter-placement=\"article-midpoint\" aria-labelledby=\"cs-inline-newsletter-1-title\" aria-describedby=\"cs-inline-newsletter-1-copy\">\n<div class=\"cs-inline-newsletter__inner\">\n<div class=\"cs-inline-newsletter__content\">\n<div class=\"cs-inline-newsletter__editorial\">\n<p class=\"cs-inline-newsletter__eyebrow\">The Catalyst<\/p>\n<p class=\"cs-newsletter-frequency\">Daily Newsletter<\/p>\n<h2 id=\"cs-inline-newsletter-1-title\" class=\"cs-inline-newsletter__title\">Know what\u2019s moving crypto.<\/h2>\n<p id=\"cs-inline-newsletter-1-copy\" class=\"cs-inline-newsletter__copy\">Start with the stories that matter. Get the context behind the headlines and a clear view of what to watch next.<\/p>\n<\/div>\n<div class=\"cs-inline-newsletter__art\" aria-hidden=\"true\"> <img loading=\"lazy\" src=\"https:\/\/cryptoslate.com\/wp-content\/themes\/cryptoslate-2020\/images\/catalyst-newsletter-scrapbook-v3.webp\" alt=\"\" width=\"640\" height=\"640\" loading=\"lazy\" decoding=\"async\"\/><img loading=\"lazy\" class=\"lazyload\" src=\"https:\/\/cryptoslate.com\/wp-content\/themes\/cryptoslate-2020\/images\/catalyst-newsletter-scrapbook-v3.webp\" alt=\"\" width=\"640\" height=\"640\" loading=\"lazy\" decoding=\"async\"\/><\/div>\n<\/div>\n<\/div>\n<\/aside>\n<p>As a result, the legitimate payment disappears from that view, leaving the user with a manipulated transaction that appears to be awaiting confirmation.<\/p>\n<p>The attacker can then exploit Bitcoin&#8217;s Replace-by-Fee feature, which allows users to increase transaction fees to encourage miners to confirm delayed payments.<\/p>\n<p><img loading=\"lazy\" loading=\"lazy\" decoding=\"async\" class=\"aligncenter shoggoth-infographic shoggoth-infographic-portrait wp-image-576723\" src=\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/10\/exec-f88032f1-3364-4e81-a8bf-70b5ef5bf508.png\" alt=\"Electrum attack flow: a malicious server hides the original payment and substitutes an invalid attacker payment; a manual fee increase supplies fresh signatures. Trusted-server clients are exempt from this attack.\" width=\"720\" height=\"900\" srcset=\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/10\/exec-f88032f1-3364-4e81-a8bf-70b5ef5bf508.png 1122w, https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/10\/exec-f88032f1-3364-4e81-a8bf-70b5ef5bf508-240x300.png 240w, https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/10\/exec-f88032f1-3364-4e81-a8bf-70b5ef5bf508-819x1024.png 819w, https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/10\/exec-f88032f1-3364-4e81-a8bf-70b5ef5bf508-768x960.png 768w\" sizes=\"auto, (max-width: 720px) 100vw, 720px\"\/><img loading=\"lazy\" loading=\"lazy\" decoding=\"async\" class=\"lazyload aligncenter shoggoth-infographic shoggoth-infographic-portrait wp-image-576723\" src=\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/10\/exec-f88032f1-3364-4e81-a8bf-70b5ef5bf508.png\" alt=\"Electrum attack flow: a malicious server hides the original payment and substitutes an invalid attacker payment; a manual fee increase supplies fresh signatures. Trusted-server clients are exempt from this attack.\" width=\"720\" height=\"900\" srcset=\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/10\/exec-f88032f1-3364-4e81-a8bf-70b5ef5bf508.png 1122w, https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/10\/exec-f88032f1-3364-4e81-a8bf-70b5ef5bf508-240x300.png 240w, https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/10\/exec-f88032f1-3364-4e81-a8bf-70b5ef5bf508-819x1024.png 819w, https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/10\/exec-f88032f1-3364-4e81-a8bf-70b5ef5bf508-768x960.png 768w\" data-sizes=\"(max-width: 720px) 100vw, 720px\"\/><\/p>\n<p>If the victim manually increases the fee on the substituted transaction, Electrum generates fresh signatures authorizing its altered payment details. That approval makes the attacker-directed transaction valid, allowing the funds to transfer without compromising the user&#8217;s private keys.<\/p>\n<p>In the Oct. 18 incident, the attackers reportedly set the fraudulent transaction fee to zero, potentially encouraging the victim to raise it.<\/p>\n<p>The case shows how a routine wallet function can become a theft mechanism when the client accepts transaction details from an untrusted server without adequate verification.<\/p>\n<p>Electrum&#8217;s latest release introduces signature checks for wallet-owned inputs before unconfirmed transactions enter the client&#8217;s local history, preventing the reported substitution technique from reaching the fee-adjustment stage.<\/p>\n<p>The developers tagged version 4.8.3 on Oct. 23 and distributed the updated software on Oct. 24, alongside the public security disclosure.<\/p>\n<p>They advised users to download the patch from Electrum&#8217;s official website and verify complete recipient addresses and payment amounts whenever signing transactions.<\/p>\n<p>The advisory also says clients connected exclusively to trusted servers, including privately operated ones, are not exposed to this attack. The patch does not extend signature verification to every incoming transaction.<\/p>\n<\/div>\n<p>Featured,Hacks,Technology,Wallets,Bitcoin,BTC,paymentsBitcoin,BTC,payments#Hackers #steal #Bitcoin #private #keys1793008248<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Bitcoin wallet Electrum has patched a security flaw that allowed hackers to redirect payments when users tried to increase transaction fees. The developers disclosed the vulnerability on Oct. 24, confirming that malicious servers had exploited the weakness and that at least one user lost Bitcoin after unknowingly approving a fraudulent transaction. The high-severity vulnerability affects<\/p>\n","protected":false},"author":1,"featured_media":14931,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[8],"tags":[91,285,1756,354,167,353,831],"class_list":["post-14930","post","type-post","status-publish","format-standard","has-post-thumbnail","category-ethereum","tag-bitcoin","tag-btc","tag-hackers","tag-keys","tag-payments","tag-private","tag-steal"],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v26.6 (Yoast SEO v26.6) - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Hackers found a way to steal Bitcoin without private keys - Crypto News: Latest Cryptocurrency News and Analysis<\/title>\n<meta name=\"description\" content=\"Bitcoin wallet Electrum patched a high-severity flaw after hackers exploited transaction fee increases to redirect payments and steal funds.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/cryptonews.uk.com\/?p=14930\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Hackers found a way to steal Bitcoin without private keys\" \/>\n<meta property=\"og:description\" content=\"Bitcoin wallet Electrum patched a high-severity flaw after hackers exploited transaction fee increases to redirect payments and steal funds.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/cryptonews.uk.com\/?p=14930\" \/>\n<meta property=\"og:site_name\" content=\"Crypto News: Latest Cryptocurrency News and Analysis\" \/>\n<meta property=\"article:published_time\" content=\"2026-10-26T09:50:48+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/10\/electrum-wallet-signing-risk.webp\" \/>\n\t<meta property=\"og:image:width\" content=\"1280\" \/>\n\t<meta property=\"og:image:height\" content=\"720\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/webp\" \/>\n<meta name=\"author\" content=\"\u884c\u653f\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"\u884c\u653f\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/cryptonews.uk.com\/?p=14930\",\"url\":\"https:\/\/cryptonews.uk.com\/?p=14930\",\"name\":\"Hackers found a way to steal Bitcoin without private keys - Crypto News: Latest Cryptocurrency News and Analysis\",\"isPartOf\":{\"@id\":\"https:\/\/cryptonews.uk.com\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/cryptonews.uk.com\/?p=14930#primaryimage\"},\"image\":{\"@id\":\"https:\/\/cryptonews.uk.com\/?p=14930#primaryimage\"},\"thumbnailUrl\":\"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/10\/electrum-wallet-signing-risk.webp\",\"datePublished\":\"2026-10-26T09:50:48+00:00\",\"author\":{\"@id\":\"https:\/\/cryptonews.uk.com\/#\/schema\/person\/822778c5844e0d16d43dce6630f4f1bf\"},\"description\":\"Bitcoin wallet Electrum patched a high-severity flaw after hackers exploited transaction fee increases to redirect payments and steal funds.\",\"breadcrumb\":{\"@id\":\"https:\/\/cryptonews.uk.com\/?p=14930#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/cryptonews.uk.com\/?p=14930\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/cryptonews.uk.com\/?p=14930#primaryimage\",\"url\":\"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/10\/electrum-wallet-signing-risk.webp\",\"contentUrl\":\"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/10\/electrum-wallet-signing-risk.webp\",\"width\":1280,\"height\":720},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/cryptonews.uk.com\/?p=14930#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/cryptonews.uk.com\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Hackers found a way to steal Bitcoin without private keys\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/cryptonews.uk.com\/#website\",\"url\":\"https:\/\/cryptonews.uk.com\/\",\"name\":\"Crypto News: Latest Cryptocurrency News and Analysis\",\"description\":\"Latest Crypto &amp; Bitcoin News\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/cryptonews.uk.com\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/cryptonews.uk.com\/#\/schema\/person\/822778c5844e0d16d43dce6630f4f1bf\",\"name\":\"\u884c\u653f\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/cryptonews.uk.com\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/e4c2d23409b09e004cef3facbe677e95c5401f9e29680f3a311e0130c5748089?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/e4c2d23409b09e004cef3facbe677e95c5401f9e29680f3a311e0130c5748089?s=96&d=mm&r=g\",\"caption\":\"\u884c\u653f\"},\"sameAs\":[\"http:\/\/demo3.aiwalls.com\/coinbase\"],\"url\":\"https:\/\/cryptonews.uk.com\/?author=1\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Hackers found a way to steal Bitcoin without private keys - Crypto News: Latest Cryptocurrency News and Analysis","description":"Bitcoin wallet Electrum patched a high-severity flaw after hackers exploited transaction fee increases to redirect payments and steal funds.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/cryptonews.uk.com\/?p=14930","og_locale":"en_US","og_type":"article","og_title":"Hackers found a way to steal Bitcoin without private keys","og_description":"Bitcoin wallet Electrum patched a high-severity flaw after hackers exploited transaction fee increases to redirect payments and steal funds.","og_url":"https:\/\/cryptonews.uk.com\/?p=14930","og_site_name":"Crypto News: Latest Cryptocurrency News and Analysis","article_published_time":"2026-10-26T09:50:48+00:00","og_image":[{"width":1280,"height":720,"url":"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/10\/electrum-wallet-signing-risk.webp","type":"image\/webp"}],"author":"\u884c\u653f","twitter_card":"summary_large_image","twitter_misc":{"Written by":"\u884c\u653f","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/cryptonews.uk.com\/?p=14930","url":"https:\/\/cryptonews.uk.com\/?p=14930","name":"Hackers found a way to steal Bitcoin without private keys - Crypto News: Latest Cryptocurrency News and Analysis","isPartOf":{"@id":"https:\/\/cryptonews.uk.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/cryptonews.uk.com\/?p=14930#primaryimage"},"image":{"@id":"https:\/\/cryptonews.uk.com\/?p=14930#primaryimage"},"thumbnailUrl":"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/10\/electrum-wallet-signing-risk.webp","datePublished":"2026-10-26T09:50:48+00:00","author":{"@id":"https:\/\/cryptonews.uk.com\/#\/schema\/person\/822778c5844e0d16d43dce6630f4f1bf"},"description":"Bitcoin wallet Electrum patched a high-severity flaw after hackers exploited transaction fee increases to redirect payments and steal funds.","breadcrumb":{"@id":"https:\/\/cryptonews.uk.com\/?p=14930#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/cryptonews.uk.com\/?p=14930"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/cryptonews.uk.com\/?p=14930#primaryimage","url":"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/10\/electrum-wallet-signing-risk.webp","contentUrl":"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/10\/electrum-wallet-signing-risk.webp","width":1280,"height":720},{"@type":"BreadcrumbList","@id":"https:\/\/cryptonews.uk.com\/?p=14930#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/cryptonews.uk.com\/"},{"@type":"ListItem","position":2,"name":"Hackers found a way to steal Bitcoin without private keys"}]},{"@type":"WebSite","@id":"https:\/\/cryptonews.uk.com\/#website","url":"https:\/\/cryptonews.uk.com\/","name":"Crypto News: Latest Cryptocurrency News and Analysis","description":"Latest Crypto &amp; Bitcoin News","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/cryptonews.uk.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/cryptonews.uk.com\/#\/schema\/person\/822778c5844e0d16d43dce6630f4f1bf","name":"\u884c\u653f","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/cryptonews.uk.com\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/e4c2d23409b09e004cef3facbe677e95c5401f9e29680f3a311e0130c5748089?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/e4c2d23409b09e004cef3facbe677e95c5401f9e29680f3a311e0130c5748089?s=96&d=mm&r=g","caption":"\u884c\u653f"},"sameAs":["http:\/\/demo3.aiwalls.com\/coinbase"],"url":"https:\/\/cryptonews.uk.com\/?author=1"}]}},"_links":{"self":[{"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/posts\/14930","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=14930"}],"version-history":[{"count":0,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/posts\/14930\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/media\/14931"}],"wp:attachment":[{"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=14930"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=14930"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=14930"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}