According to Unchained, certain Electrum servers are operating maliciously by prompting users to increase transaction fees under the guise of improving confirmation speed. These servers appear legitimate to users who connect through them, often recommended via unofficial resources or peer suggestions.
When a user initiates a Bitcoin transfer using such a server, the server responds by suggesting a significantly higher fee than standard network levels. The server then waits for the user to accept this increased amount before broadcasting the transaction. Once the higher-fee transaction is sent, the server includes an additional output directing the funds to itself.
Because the transaction now carries a higher fee, it is more likely to be included quickly in a block by miners or validators following standard economic incentives. The malicious server benefits from receiving the portion directed to it, while the user’s intended recipient receives only the remainder of the original amount minus the elevated fee.
The technique exploits normal Electrum client behavior: users often accept fee suggestions without verifying destination addresses when prompted by the server. No indication is provided to users that increasing the fee sends part of their Bitcoin to the server operator. The process occurs in a single interaction; there is no separate step or confirmation from the user directing funds to the server.
Researchers identified the pattern through analysis of Electrum server interactions and transaction flows. Users who connected to unaffected, legitimate servers did not experience this outcome. The issue relates to how Electrum processes fee suggestions from servers and does not involve server authentication failure or external hacking of user devices.
