Electrum Bitcoin Wallet Releases 4.8.4 Security Update to Fix Lightning Network Vulnerability

Electrum, the open-source lightweight Bitcoin wallet first released in 2011, has published version 4.8.4. The update is mainly a security release. It fixes a Lightning Network flaw that could cut the wallet off from its payment channel peers, and it also fixes several stability and usability problems on desktop and Android. The developers have named it the “15th Anniversary Edition.”

The project’s official release notes date version 4.8.4 to November 6, 2026. Signed installers for Windows, macOS, Linux, and Android were posted to Electrum’s download server on November 8, and the project announced the release on X.

What the Lightning Network Vulnerability Did

The Lightning Network is a layer-2 payment network built on top of Bitcoin. Two parties lock funds in a shared payment channel and can then trade near-instant, low-fee payments off the main blockchain. A wallet’s “peers” are the Lightning nodes it has open channels with.

The flaw involved onion messages. These are a Lightning protocol feature for sending data, rather than payments, across the network. The data is wrapped in layers of encryption so that each node along the route can see only the next hop.

According to the release notes, malformed onion messages from arbitrary sources could force Electrum to disconnect from its channel peers. While a peer is disconnected, the wallet cannot send or receive Lightning payments through that channel until the connection comes back. Electrum has not reported any loss of funds linked to this issue.

To fix it, the developers made Electrum drop all incoming onion messages for now. They will stay disabled until the wallet implements actual use cases for them. The release notes credit security reports from Felipe Knorr Kuhn (knorrium), muntedcrocodile, and haoxucu.

Other Fixes in Electrum 4.8.4

Besides the Lightning fix, the release notes list several bug fixes:

• Legacy seed recovery: Some seed phrases created before Electrum 2.0 could not be restored from version 4.6.1 onward. That is now fixed. A seed phrase is the list of words that can rebuild a wallet and all of its private keys.
• Long transaction chains: Computing child transactions was slow, and long chains could cause recursion errors. A child transaction spends an output of an earlier, unconfirmed transaction.
• Desktop performance: In large wallets, the Coins tab could freeze in the desktop interface, which is built on the Qt application framework.
• Wallet file handling: Opening invalid or unreadable wallet files now produces better errors and fewer crashes.
• Android: Several crashes and display problems were fixed in the Android app, whose interface uses QML (Qt Modeling Language). The app also gains a new address history page.

Fourth Security Release Since August

Electrum’s release notes label every version from 4.8.1 onward as a security update. Version 4.8.1 is dated August 10, 2026, and version 4.8.2 is dated September 11. Among other changes, 4.8.2 fixed channel backups for anchor channels in wallets with non-deterministic Lightning keys. Those backups were missing a key needed to sweep funds after the remote party force-closed a channel, so affected users were told to export new backups.

Version 4.8.3 is dated October 23 in the release notes. It fixed a high-severity flaw described in GitHub Security Advisory GHSA-6jp4-8v48-cc5v, which was published on October 24. A malicious Electrum server could hide a transaction the user had just broadcast and show a substitute transaction paying an attacker’s address. If the user then tried to speed it up with Replace-by-Fee (RBF), the wallet could sign a valid version of the attacker’s transaction. RBF is a Bitcoin feature that lets a sender replace an unconfirmed transaction with one that pays a higher fee.

The advisory followed two private reports from users, and at least one user reported losing funds after bumping the fee on a substituted transaction. Users who connect only to their own server or a server they trust were not exposed to that specific attack.

Wallet Security Remains Under Pressure

The Electrum updates come during a busy period for Bitcoin software security. In August, BTCPay Server warned of a critical flaw that was being actively exploited. A firmware flaw in Coldcard hardware wallets weakened seed generation, and attackers swept funds from affected single-signature wallets. Across the wider market, October 2026 became the worst month on record for crypto hacks.

The 4.8.4 flaw had a narrower impact than the 4.8.3 server issue, since it caused disconnections rather than misdirected payments. Still, it shows that Lightning features add attack surface that wallet developers have to keep hardening, even in software that has been in development for 15 years.

How Users Can Update Safely

The developers recommend downloading Electrum only from the official download page. Each release on the download server has signature files from several independent developers. Users can check these with GPG (GNU Privacy Guard) to confirm the installer has not been altered. Electrum also publishes reproducible builds, which lets anyone check that the published binaries match the public source code.

Fake wallet software is a common way attackers steal funds. In August, researchers uncovered counterfeit wallet apps built to steal recovery phrases. Updating Electrum does not require entering a seed phrase, so users should not share their seed phrase with anyone during the upgrade.

Also Read: Vitalik Buterin Says ETH Should Be a Store of Value, Not a Fee-Burning Token