In one documented attack against user dannydeezy, a rogue Electrum server's substituted transaction matched dannydeezy's original transaction's inputs and locktime while directing funds to a fake destination ending in GyQ3