Electrum has released version 4.8.3 after discovering a serious vulnerability that allowed malicious servers to redirect Bitcoin payments to attackers. Developers have confirmed that at least one user lost money because of this attack.

The problem was related to how Electrum handles unconfirmed transactions. Attackers could replace a legitimate transaction with a fake one, changing the receiving address. When users tried to increase the transaction fee, they could unknowingly sign a transaction sending their Bitcoin to the attacker instead.

What makes this interesting is that the attack targeted the wallet's reliance on external servers, rather than requiring users to download fake wallet software.

My opinion is that this is another reminder that even when you're using a legitimate wallet, you still need to understand how it works and what you're trusting. If you're using a lightweight wallet that depends on external servers, you're still relying on someone else's infrastructure.

Electrum has fixed the issue in version 4.8.3, so if you're using it, make sure you update your wallet.