The Second Signature: Electrum's Fee-Bump Flaw and the Trust Boundary Nobody Audited

Data shows the loss did not come from a stolen key. Two users were affected. One lost funds. In both cases the first payment was correct — broadcast, valid, exactly what the sender intended. The money left on the second signature, the one the wallet requested when the user tried to raise the fee. That is the whole event, and it is the most instructive part of it.

I once spent 180 hours inside a wallet's delegation logic — Tezos, late 2017, tracing Michelson execution paths by hand. Three flaws, two patched within weeks, the third left standing. The lesson held: the dangerous code is rarely the code that moves the money. It is the code that describes what the money is doing.

Electrum is a light client. It does not download the chain. It asks a server what happened, and for confirmed transactions it verifies the proof itself. Unconfirmed history is different. That data arrives from a third party — servers run by volunteers and institutions, selected automatically by the client, invisible to the person signing.

That asymmetry is the architecture. It has been the architecture for a decade, and it buys something real: no hundreds of gigabytes of storage, no week of initial sync, no always-on machine. The trade is trust for convenience, made explicitly, priced at zero because nobody had itemized the bill.

On October 24 — the year is not stated in the material I reviewed, and that omission matters, because it determines whether version 4.8.3 shipped ahead of exploitation or behind it — Electrum's maintainers disclosed a flaw and published a patch. Signed packages are listed on electrum.org. The announcement carries an explicit warning about forged "fix" downloads. Those are the verifiable facts. Everything after this paragraph is inference, and I will mark it.

The chain, as reconstructed:

(1) legitimate first payment broadcasts and confirms
(2) malicious server substitutes the unconfirmed history entry
(3) user sees a pending transaction and raises the fee
(4) wallet requests a second signature
(5) the signed replacement pays the attacker; settlement is final

Tracing the ghost in the ledger, byte by byte. The first payment is real. It propagates, it confirms, the user is satisfied. What the server controls is the description of what is still pending — and that description is editable.

Three findings follow.

The vulnerability class is authorization-semantics deception, not key compromise. No private key leaked. The user signed deliberately, on a working device, in a session they initiated. The interface said the signature meant "pay more for the same transfer." It meant "pay someone else." Every wallet model I have audited treats this as the worst category, because it defeats every control except reading the raw outputs.

The trust boundary was too wide. The client never cryptographically anchored the pending transaction to the one it had signed, so a server could substitute the body while the interface kept the label. Electrum's own phrasing — a weakness in wallet history — points the same direction. What I cannot verify is the check that now exists: local fingerprint of signed transactions, output whitelist comparison, or forced full output display. The mechanism is undisclosed. Confidence: medium.

Note what the patch cannot do. Confirmed transactions were always verified locally; unconfirmed history is still described by a stranger. Hardening the comparison logic raises the cost of substitution. It does not remove the third party. Anyone reading 4.8.3 as "solved" is reading a mitigation as an elimination.

Preconditions are not trivial. A malicious or compromised server, plus a user-initiated fee bump, plus a user who does not read the outputs of the replacement. Three conditions, and only the third belongs to the user. That explains two victims and one loss. It does not explain safety. The number that would settle the risk question is not published: how many clients connected to a hostile server before the patch shipped. Without that base, the infection rate is unknowable, and "only two users" becomes a comforting story rather than a measurement.

Now the economics, which is where this gets uncomfortable. The attacker's inputs are one server and patience. No hashpower, no capital, no exploit chain, no smart contract. The output is whatever the victim signs. That ratio is absurd, and it is why the pattern will recur with or without 4.8.3.

The economic carrier is not a token — Electrum has none, no funding round, no incentive layer, no unlock schedule. It is the fee market. Bump-fee anxiety is the fuel: congestion makes users eager to pay more quickly, and eagerness is the condition the attack requires. Treat fee spikes as an attack calendar, not an inconvenience.

The remediation is the second attack. A user who learns "upgrade or lose funds" and then searches for a binary is the ideal target. Forged domains, forged 4.8.3, forged signatures. The only defensible path is electrum.org and a signature check performed before installation, not after.

Custody inherits the same surface. Shared-key collateral structures and insured custody arrangements have to state precisely what one signature authorizes — not what it was intended to authorize. An operator running a light client as a back-office console is exposed to the identical deception, with a larger balance.

Hardware signers are not automatically immune. If the device renders a digest the human cannot parse while the host renders the summary, the last line of defense is decorative. Confidence: low, direction only — the source material does not address the fee-bump flow on hardware devices.

Design, not cryptography, is the fix surface. A dialog that says "increase fee" and shows a single number cannot express a change of payee. Any interface that collapses "same transaction, higher fee" and "different transaction" into one prompt has already failed, regardless of what the backend verifies.

There is a regulatory edge here that most technical write-ups skip. The prevailing enforcement posture treats publishing code as potentially actionable; the Tornado Cash precedent made that explicit for open-source maintainers. Electrum's team did the thing that posture claims to want — found a flaw, patched it, published signed artifacts, warned about forgeries. A liability regime that cannot distinguish between shipping a vulnerability and shipping a fix will produce fewer of these disclosures, not more. The obligation that actually matters is narrower and harder: state what a signature authorizes.

What is absent is as telling as what is present: no third-party audit disclosed, no total loss figure, no technical write-up, no exposure duration. The substitution surface is as old as SPV itself. If nobody reported it for years, the reason is attacker restraint, not attack difficulty.

Credit where the record supports it. Disclosure discipline here sits above the sector median: named version, official domain, signature verification instructions, explicit phishing warning, published victim count. Withholding exploit mechanics is correct practice — it denies a template to everyone who has not patched. Demanding public detail is demanding a weapon.

The defenders are also right that SPV is not stupidity. A user on a metered connection, in a jurisdiction with unreliable infrastructure, has a rational reason to prefer a light client. The tradeoff is real, and "run a full node" is not an answer, it is a slogan.

The loudest misreading deserves correction too. This is a client bug, not a Bitcoin bug. No consensus change, no supply event, no institutional flow. The chain never lies, only the observers do — and here the observers are reading a wallet advisory as a protocol verdict.

Where the defenders are wrong: two victims is not a denominator. It is a numerator with no published base. Sifting through the noise to find the signal, low counts in security disclosure measure restraint and reach, not immunity.

The patch closes a known path. It does not close the class. Watch three things: whether "does this client require a third party to describe my history" becomes a line item in wallet selection; whether disclosure rules mature before the next coordinated window; whether fee spikes get read as an attack calendar. The update only works when installed. The boundary only closes when a client can prove what it asked you to sign. Flaws hide in the decimal places — and in the second dialog box.