Electrum: a malicious server substitutes a just-sent transaction to steal funds when the fee is bumped

According to the advisory, a server connected to a lightweight client can “swallow” a broadcast transaction and show a conflicting forgery in the history with the same inputs but an output to the attacker's address; the forged transaction's signatures were not checked because of the lightweight client's design. If the user manually increases the fee on that transaction, they sign and fund a transfer to the attacker. The developers report that some servers are carrying out this attack in practice: they received two private reports from users, one of whom lost funds; the forged address was chosen so that its last four characters matched those of the legitimate address. The fix is included in version 4.8.3 — the client verifies signatures for its own (is_mine) inputs in mempool transactions; “incoming” transactions with other people's inputs are still not validated. The advisory is linked in the post.