A Tailscale Bug and a Patched Electrum Flaw Hit Bitcoin's Self-Custody Tools This Week

Bitcoin's own software stack took two separate hits this week, on top of a wave of outages that knocked Japanese banks, airlines and government agencies offline. One flaw in the Electrum wallet already led to a confirmed theft before it was patched. A second, still unpatched, affects Tailscale, a tool a lot of Bitcoiners use to reach their nodes remotely.

THE ELECTRUM FLAW THAT ALREADY COST SOMEONE BITCOIN

Electrum, one of the oldest Bitcoin wallets still in wide use, shipped version 4.8.3 on October 24 to fix a high severity vulnerability that let malicious servers redirect outgoing payments. Electrum does not run a full node itself. It leans on external servers for transaction history and broadcasting, and before the patch, it accepted information about unconfirmed transactions from those servers without checking the signatures. A malicious server could swap in a fake transaction when a user tried to speed up a payment with a higher fee, sending the funds to an attacker's address while Electrum displayed it as an ordinary pending transaction.

Developers received two reports of the issue in October, including one from a user who lost funds after approving what looked like a routine fee bump. Anyone still running a version of Electrum older than 4.8.3 remains exposed until they update.

A SEPARATE BUG IN TAILSCALE THREATENS NODE OPERATORS

Security researcher Erica Windisch of Cyberdione Labs disclosed a different problem this week in a report called Tailworm. It describes a flaw in Tailscale SSH, running version 1.104.2, and in headscale, the self-hosted alternative, running version 0.29.5. If an attacker already controls one device on a network and SSH port forwarding is turned on, that foothold is enough to gain root access on other devices the network's access rules permit it to reach, without needing a password or a key.

Tailscale has acknowledged the report and is investigating with outside researchers, but no patch has shipped yet. A number of Bitcoin node operators use Tailscale specifically to reach their nodes over SSH without exposing them directly to the internet. Until a fix lands, the practical move is to turn off SSH port forwarding and tighten access rules to specific device pairs rather than broad group permissions.

JAPAN'S BANKS AND RAILWAYS WENT DARK FOR A DIFFERENT REASON

None of this was connected to what hit Japan over the same stretch. Critical flaws in PHP, the programming language that runs a large share of the web, forced Nomura, Mitsubishi UFJ Financial Group, ANA and East Japan Railway to suspend some online services as a precaution. Japan's Ministry of Finance, National Tax Agency and Meteorological Agency did the same. PHP's developers released patches for the flaws on October 21, and the shutdowns were a defensive response to those patches rather than evidence of a successful breach at any of the companies involved.

The real risk this week was never one event taking down the internet. It was two unrelated software bugs landing in the same seven days, one of them in a wallet people actually use to hold Bitcoin. If you run a node through Tailscale, turn off SSH port forwarding until a patch ships. If Electrum is still open on an older version, update it now.

This story comes from the Simply Bitcoin Live show. Watch the full episode.