A malicious bitcoin wallet server could quietly swap a legitimate payment for a thief’s transaction, then wait for its owner to approve the theft. Electrum’s latest security patch closes that loophole after attackers exploited the flaw and stole funds.