El Salvador purchased additional bitcoin for its Strategic Bitcoin Reserve, bringing its total holdings to 7,817 BTC. The purchase increases the reserve as the country keeps adding BTC.

Electrum released version 4.8.3 on October 24 to fix a critical vulnerability that let malicious servers inject forged transactions and steer user funds to attacker-controlled addresses. The update follows reports of at least one confirmed loss. All versions before 4.8.3 were affected. The attack exploited how Electrum handles unconfirmed transactions. When a user broadcasts a payment through a compromised server, the server can block the legitimate transaction and inject a conflicting forged transaction. That forged transaction—showing an attacker output address and zero fee—makes the payment appear stuck. Because Electrum did not verify signatures on unconfirmed transactions received from servers, the forged item appeared in wallet history as valid. If the user then fee-bumped the stalled payment, they signed and broadcast a new valid transaction paying the attacker. The original payment never reached the network; the fee-bumped transaction did, and it paid the attacker. Electrum developer SomberNight said attackers could alter the output address of a forged transaction to match the last four characters of the intended address. Someone checking only the end of a long Bitcoin address would see an apparent match. The announcement said some servers were actively carrying out this attack, a claim supported by two user reports. User dannydeezy first flagged suspicious server behavior on October 11. No funds were lost in that case because the altered transactions did not propagate beyond the local server. A second user, RajuK12, reported a confirmed loss on October 18 after paying extra fees to correct an altered transaction. Version 4.8.3 closes the main attack vector by verifying cryptographic signatures on inputs belonging to the wallet before adding unconfirmed transactions to local history. A server can no longer inject forged transactions involving the user address without valid signatures, which attackers cannot produce. The fix was marked in the code repository on October 23, and the binary was released the next day. Incoming transactions from external senders—those with no inputs from the user wallet—are still accepted without signature verification. SomberNight acknowledged this gap and said more work is needed. Electrum, one of the earliest Bitcoin software wallets, has faced similar incidents before. In 2018, a malicious attack used forged servers to push fake update notifications, and by 2020 such attacks were estimated to have stolen $25 million from Electrum users. The open-server model, in which anyone can run a node, makes these attacks possible. Users connected only to their own servers are unaffected. Users who cannot update immediately should manually verify the output address and amount before signing any transaction. Electrum 4.8.3 is available at electrum.org and on the project GitHub repository.

Strategy spent a record $204.9 million retiring 2.07 million STRC preferred shares last week, pushing buybacks past $2 billion since July. It bought no Bitcoin from Oct. 19 to Oct. 25, holding 848,517 BTC, as unrestricted cash fell 84.8% to $242.4 million. Strive bought a record 6,182 BTC for about $511.4 million, lifting holdings to 43,000 BTC. Investors vote Oct. 28 on daily dividends.

Strategy spent a record $204.9 million retiring 2.07 million STRC preferred shares last week and bought no Bitcoin from Oct. 19 to Oct. 25. Its Bitcoin holdings stayed at 848,517 BTC, acquired for about $64.02 billion. Strive acquired a record 6,182 BTC for about $511.4 million between Oct. 17 and Oct. 23, raising holdings to 43,000 BTC.

Z nieznanego portfela na rzecz Coinbase Institutional przelano 753 BTC o wartości 60 466 629 USD.

Keystone will destroy 18,835 hardware wallets after attackers stole the key that verifies device authenticity. The breach began October 20 via a flaw in a third party monitoring tool on its website, exposing 25,964 customer records and 12,873 abandoned checkout records. Recovery phrases and private keys were not compromised. Shipments are suspended and production shifts to a new authentication key.

Bitcoin has entered an accumulation phase and could retake $125,000, per Galaxy Digital. The 50-week moving average near $76,540 held for five weekly closes as of October 18. The current 53% drawdown is the shallowest versus prior 93%, 85% and 84% cycles. Spot Bitcoin ETFs added 87,000 BTC since June while hedge funds cut 68,000 BTC. A weekly close below the 50-week average invalidates the thesis.

Public company Strive purchased 6,182 Bitcoin for $511.4 million at an average price of $82,700. The acquisition brings Strive's total Bitcoin holdings to 43,000 BTC. Additionally, the company announced a new $1 billion at-the-market program for its SAT shares.