But the wallet then displayed the fake payment as pending, and the trap came when users tried to speed things up.
Bitcoin allows unconfirmed transactions to be replaced with versions carrying higher fees, a feature called Replace-by-Fee. If a user selected that option, Electrum could take the fraudulent transaction and sign a valid replacement, sending the coins to the attacker.
In one reported case, the malicious transaction carried no fee at all, making it appear stuck. Attackers also generated receiving addresses whose last four characters matched the legitimate destination, making the substitution harder to spot during a quick check.
The first report, submitted Oct. 11, involved a two-of-three multisignature wallet using two Trezor hardware devices. The user had checked the legitimate payment on both devices but later noticed a different outgoing transaction in the wallet’s history (that user did not report losing funds).
A second…
