Attackers running malicious Electrum servers generated lookalike receiving addresses matching the final four characters of legitimate payment destinations to deceive users checking transaction histories