Electrum released version 4.8.3 on October 24 to fix a critical vulnerability that let malicious servers inject forged transactions and steer user funds to attacker-controlled addresses. The update follows reports of at least one confirmed loss. All versions before 4.8.3 were affected. The attack exploited how Electrum handles unconfirmed transactions. When a user broadcasts a payment through a compromised server, the server can block the legitimate transaction and inject a conflicting forged transaction. That forged transaction—showing an attacker output address and zero fee—makes the payment appear stuck. Because Electrum did not verify signatures on unconfirmed transactions received from servers, the forged item appeared in wallet history as valid. If the user then fee-bumped the stalled payment, they signed and broadcast a new valid transaction paying the attacker. The original payment never reached the network; the fee-bumped transaction did, and it paid the attacker. Electrum developer SomberNight said attackers could alter the output address of a forged transaction to match the last four characters of the intended address. Someone checking only the end of a long Bitcoin address would see an apparent match. The announcement said some servers were actively carrying out this attack, a claim supported by two user reports. User dannydeezy first flagged suspicious server behavior on October 11. No funds were lost in that case because the altered transactions did not propagate beyond the local server. A second user, RajuK12, reported a confirmed loss on October 18 after paying extra fees to correct an altered transaction. Version 4.8.3 closes the main attack vector by verifying cryptographic signatures on inputs belonging to the wallet before adding unconfirmed transactions to local history. A server can no longer inject forged transactions involving the user address without valid signatures, which attackers cannot produce. The fix was marked in the code repository on October 23, and the binary was released the next day. Incoming transactions from external senders—those with no inputs from the user wallet—are still accepted without signature verification. SomberNight acknowledged this gap and said more work is needed. Electrum, one of the earliest Bitcoin software wallets, has faced similar incidents before. In 2018, a malicious attack used forged servers to push fake update notifications, and by 2020 such attacks were estimated to have stolen $25 million from Electrum users. The open-server model, in which anyone can run a node, makes these attacks possible. Users connected only to their own servers are unaffected. Users who cannot update immediately should manually verify the output address and amount before signing any transaction. Electrum 4.8.3 is available at electrum.org and on the project GitHub repository.

Strategy 上周動用創紀錄的 2.049 億美元，回購並註銷 207 萬股 STRC 優先股。自 7 月啟動回購計劃以來，累計投入已超過 20 億美元。 10 月 19 日至 25 日，Strategy 未買入任何比特幣，連續五周的增持就此中斷，為 9 月中以來首次整周停手。公司亦未透過「按市價發行」（ATM）股票計劃籌集資金。比特幣持倉維持在 848,517 枚，累計買入成本約 640.2 億美元。 比特幣分析師 Ragnar 估算，Strategy 上周貢獻了 STRC 成交量的 28%，反映其對需求的帶動作用。STRC 已收復 6 月比特幣拋售期間的大部分失地，當時該優先股一度跌至 71 美元，面值則為 100 美元。Strategy 最初正是利用折價回購，以縮減優先股資本及未來派息承諾。公司曾公開表示，隨著 STRC 價格接近 100 美元，將放慢回購力度。首筆 2,500 萬美元回購均價為每股 86.52 美元，最新一筆則約為 99.06 美元。折價收窄之下，每周回購金額反而持續攀升，佔用了原本可用於買入比特幣的現金。 最新報告周內，Strategy 可自由動用的美元現金由 16 億美元降至 2.424 億美元，減幅 84.8%。公司未動用另一筆 48.3 億美元、專門用於優先股派息及債務利息的儲備。在把優先股回購授權提高至 30 億美元後，Strategy 仍餘下 9.568 億美元回購額度。 市場觀察人士認為，Strategy 的下一步或可降低進一步干預 STRC 市場的必要。公司將於 10 月 28 日（周三）尋求股東批准優先證券按日派息，取代 STRC 每月兩次的派息安排。提案可讓投資者更頻密地收取並再投資收益，亦有助緩和派息日前後的價格波動。Strategy 期望按日派息能把 STRC 價格支撐在 100 美元附近，同時無須調高現行 12% 的年度股息率。Ragnar 認為，管理層或先評估按日派息能否帶來足夠的投資者需求，再考慮進一步上調股息率。若股東批准，首筆按日 STRC 派息定於 11 月 2 日，讓 Strategy 在回購額度遞減之際測試需求。 Strive 正透過高收益優先證券集資，以加快買入比特幣。10 月 17 日至 23 日，該公司創紀錄購入 6,182 枚比特幣，涉資約 5.114 億美元，持倉增至 43,000 枚，距離超越日本的 Metaplanet、成為全球第二大上市企業比特幣持有者又近一步。Strive 較 Metaplanet（持 44,000 枚）少 1,000 枚，較獲 Tether 支持的 Twenty One Capital（持 43,514 枚）少 514 枚。差距收窄，推進行政總裁 Matt Cole 在 2026 年底前把 Strive 打造成第二大企業比特幣持有者的目標。 Strive 於 10 月 20 日完成 6.3 億美元的 15% A 系列永久 SATS 優先股發行，以每股 90 美元發行 700 萬股，並承諾每股年度累計股息 15 美元。首次發行相當於每年約 1.05 億美元的派息承諾，公司已預留足以支付 18 個月的資金。周一，Strive 披露新的 10 億美元 ATM 計劃，允許繼續出售 SATS 股份，為買入比特幣、其他投資及一般企業開支提供資金。儘管完成比特幣收購，Strive 截至 10 月 23 日的現金及現金等價物由一周前的 3.175 億美元增至 5.044 億美元。 在 Strategy 創紀錄回購的一周內，Strive 持有的 505,000 股 Strategy STRC 優先股維持不變，價值約 5,020 萬美元。優先股融資帶來經常性開支，規模可能隨 Strive 的比特幣持倉增加而上升。Strive 招股書指出，未來的 SATS 現金股息預計主要靠進一步集資支付，因此持續的投資者需求至關重要。新授權並不保證公司能籌足全部 10 億美元，後續發售的時機與規模將取決於市況及市場對 SATS 股份的需求。

Strategy上周動用破紀錄的2.049億美元，贖回207萬股STRC優先股。自7月啟動回購以來，累計支出已超過20億美元。公司在10月19日至25日期間未買入任何比特幣，結束連續五周增持，為9月中以來首次周度暫停。同期亦未透過ATM股權計劃集資。比特幣持倉維持在848,517 BTC，購入成本約640.2億美元。比特幣分析師Ragnar估計，Strategy最新一周佔STRC成交量28%，反映其對需求的貢獻。STRC已收復6月比特幣拋售期間的大部分失地；當時STRC價格一度跌至71美元，而面值為100美元。Strategy最初藉折價回購，減少流通優先股資本及未來派息承諾，並公開表示當STRC接近100美元時會降低回購力度。首筆2,500萬美元回購均價為每股86.52美元，最新一筆約99.06美元。儘管折價收窄，每周回購金額仍持續增加。較大規模的回購消耗了原本可用於買入比特幣的現金。最新報告周內，未受限美元現金由16億美元降至2.424億美元，跌幅84.8%。公司未動用另一筆48.3億美元、用於優先股股息及債務利息的儲備。在將優先股回購授權提高至30億美元後，Strategy仍保留9.568億美元回購額度。市場觀察人士認為，Strategy下一步可能降低進一步干預STRC市場的需要。公司將於10月28日（周三）要求股東批准優先證券改為每日派息，取代STRC現行每月兩次的安排。建議可讓投資者更頻密收取及再投資收益，亦有助緩和派息日附近的價格波動。Strategy希望每日派息可支持STRC價格靠近100美元，同時不提高現行12%年度股息率。Ragnar認為，管理層可能先評估每日派息能否帶來足夠投資者興趣，再考慮另一次上調股息率。若股東批准，首次每日STRC派息定於11月2日，讓公司在剩餘回購額度減少之際測試需求。Strive則透過高息優先證券集資，加快買入比特幣。公司在10月17日至23日破紀錄購入6,182 BTC，涉資約5.114億美元。持倉增至43,000 BTC，距離超越日本Metaplanet、成為全球第二大上市企業比特幣持倉者更近一步。Strive較Metaplanet的44,000 BTC少1,000 BTC，較Tether支持的Twenty One Capital的43,514 BTC少514 BTC。差距收窄推進了行政總裁Matt Cole的目標：在2026年底前令Strive成為第二大企業比特幣持倉者。Strive於10月20日完成6.3億美元、15% A系列永久SATS優先股發行，以每股90美元發行700萬股，並承諾每股累積年度股息15美元。首次發行產生約1.05億美元年度化股息承諾。公司預留足夠18個月派息的資金。周一，Strive披露新的10億美元ATM計劃，允許進一步出售SATS股份，以資助比特幣購買、其他投資及一般企業開支。儘管買入比特幣，截至10月23日，Strive現金及現金等價物由一周前的3.175億美元升至5.044億美元。在Strategy創紀錄回購的一周內，Strive持有的505,000股Strategy STRC優先股維持不變，價值約5,020萬美元。不過，優先股融資會產生經常性開支，並可能隨Strive比特幣持倉增加而上升。Strive招股書稱，未來SATS現金股息預期主要靠進一步集資支付，因此持續的投資者需求至關重要。新授權不保證Strive可籌足10億美元；市場狀況及SATS股份需求將決定後續出售的時機與規模。

An unidentified wallet transferred 753 BTC, valued at $60,466,629, to Coinbase Institutional.

Keystone will destroy 18,835 hardware wallets after attackers stole the key that verifies device authenticity. The breach began October 20 via a flaw in a third party monitoring tool on its website, exposing 25,964 customer records and 12,873 abandoned checkout records. Recovery phrases and private keys were not compromised. Shipments are suspended and production shifts to a new authentication key.

Bitcoin has entered an accumulation phase and could retake $125,000, per Galaxy Digital. The 50-week moving average near $76,540 held for five weekly closes as of October 18. The current 53% drawdown is the shallowest versus prior 93%, 85% and 84% cycles. Spot Bitcoin ETFs added 87,000 BTC since June while hedge funds cut 68,000 BTC. A weekly close below the 50-week average invalidates the thesis.

Public company Strive purchased 6,182 Bitcoin for $511.4 million at an average price of $82,700. The acquisition brings Strive's total Bitcoin holdings to 43,000 BTC. Additionally, the company announced a new $1 billion at-the-market program for its SAT shares.

Electrum released version 4.8.3 on October 24 to fix a flaw that let malicious servers steal bitcoin through fake fee increases. Developers confirmed at least one theft on October 18, six days before the patch. Older builds accept unconfirmed transaction data without signature checks, so an attacker can swap in a fake payment and sign a valid Replace-by-Fee replacement.