Audit log

Every state-changing event for Electrum: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-09-15 17:15:41Z
   Score: ? → ? (no score change)
   anchoranchored

   chain

   ●mainnet-betaslot 447,304,534

   sig

   3BCLePrXeypV…tnMQBcyrcopyexplorer ↗

   hash

   GSMwYBreaNAC…UHSXT1UAcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (18658 B) ▸

   {"actor":"system:backfill","investigation_id":"59ae77cf-e939-46d3-a374-83e01f3e03e9","kind":"publish","page_slug":"electrum","published_at":"2026-09-15T17:15:41.453Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Electrum","sections":[{"content":"Electrum was released in November 2011 by Thomas Voegtlin, making it one of the oldest continuously maintained Bitcoin wallets in existence. Electrum Technologies GmbH, the company behind the wallet, was incorporated in 2013. The software is open-source, released under the MIT License, and written in Python. Its canonical source code repository is hosted at github.com/spesmilo/electrum. The wallet is non-custodial — private keys are generated and stored locally on the user's device and are never transmitted to any server. Electrum supports Windows, macOS, Linux, and Android. As of late 2025, the current release is version 4.6.2. The wallet supports hardware wallet integration (Trezor, Ledger, KeepKey), multisignature configurations, and Lightning Network payments. It connects to a distributed network of ElectrumX servers rather than running a full Bitcoin node, which reduces resource requirements but introduces a network-level trust surface that has been exploited.","heading":"Background and Overview","severity":"low","sources":[{"credibility":1,"name":"Electrum Official Website","type":"official","url":"https://electrum.org/"},{"credibility":1,"name":"GitHub — spesmilo/electrum","type":"official","url":"https://github.com/spesmilo/electrum"}]},{"content":"A critical missing-authorization vulnerability in Electrum's JSONRPC interface (CVE-2018-1000022) was present in all versions from 2.6 (released March 2016) through 3.0.4. The flaw allowed any malicious website to issue commands to a locally running Electrum instance via specially crafted JavaScript, including transferring Bitcoin to attacker-controlled addresses, without requiring user authentication — provided the wallet was not password-protected. Even password-protected wallets were reportedly at risk of address substitution attacks. The vulnerability was privately reported to the developers in November 2017 by a user identified as 'jsmad,' approximately twenty months after it was introduced. An initial patch (version 3.0.4) was released but did not fully address the issue; a complete fix was shipped in version 3.0.5. CVE-2018-1000022 was published on February 9, 2018, and carries a CVSS 3.0 base score of 5.3 (Medium). No confirmed mass-exploitation of this specific vector was publicly documented, but the two-year exposure window represents a significant historical risk for users who ran Electrum with an open JSONRPC port.","heading":"2016–2018: JSONRPC Missing Authorization Vulnerability (CVE-2018-1000022)","severity":"high","sources":[{"credibility":1,"name":"CVE-2018-1000022 — CVEdetails","type":"other","url":"https://www.cvedetails.com/cve/CVE-2018-1000022/"},{"credibility":2,"name":"Electrum Bitcoin Wallets Were Vulnerable to Hackers for Two Years — Vice/Motherboard","type":"news_article","url":"https://www.vice.com/en/article/electrum-bitcoin-wallets-were-vulnerable-to-hackers-for-two-years-json-rpc/"},{"credibility":2,"name":"Electrum patches a critical flaw that exposed Bitcoin Wallets to hack since 2016 — Security Affairs","type":"news_article","url":"https://securityaffairs.com/67591/digital-id/electrum-wallet-flaw.html"}]},{"content":"In May 2018, the Electrum team publicly identified and warned users about a fraudulent copycat service called 'Electrum Pro,' operating from electrum.com (the legitimate wallet is distributed from electrum.org). The official Electrum team published a technical analysis on GitHub documenting malicious code within the fake wallet's Windows and macOS binaries that was designed to exfiltrate users' recovery seed phrases to attacker-controlled servers. The Linux version of Electrum Pro was reported to be unaffected. Electrum advised any users who may have installed the fake software to treat their seed as compromised and migrate funds immediately. The incident illustrated the risk of typosquatting and domain confusion around the Electrum brand.","heading":"2018: Electrum Pro Copycat Site","severity":"high","sources":[{"credibility":2,"name":"Electrum calls out copycat site Electrum Pro for 'bitcoin-stealing malware' — CoinGeek","type":"news_article","url":"https://coingeek.com/electrum-calls-copycat-site-electrum-pro-bitcoin-stealing-malware/"}]},{"content":"Beginning in December 2018 and continuing through at least 2020, attackers exploited a design property of the Electrum network to conduct a sustained phishing campaign that resulted in documented losses exceeding $25 million. Because Electrum's peer network is open, anyone can operate an ElectrumX server. Attackers deployed large numbers of malicious servers configured to respond to legitimate wallet transaction requests with a crafted error message directing users to download a 'required update' from an unofficial GitHub repository. Users who followed the prompt installed malware that, once executed, displayed a fake two-factor authentication prompt; the one-time code entered by the user was used to authorize an outbound transfer of all wallet funds to attacker addresses. Key documented incidents include: an initial wave in December 2018 in which approximately 200 BTC (then valued near $1 million) was stolen; a botnet-amplified phase in April 2019 in which over 152,000 compromised hosts running the malicious Electrum client were marshalled into a distributed denial-of-service botnet (dubbed ElectrumDoSMiner) targeting legitimate Electrum servers — this phase raised the total to approximately $4.6 million; and a large single-victim incident in late August 2020 in which one user reportedly lost 1,400 BTC (approximately $15.8 million at the time). ZDNet/Decrypt investigations estimated the cumulative total at approximately 1,980 BTC ($22–25 million) as of late 2020. Electrum developers acknowledged the attacks and posted repeated warnings on the official website. In a technical countermeasure, developers exploited a denial-of-service property in Electrum clients older than version 3.3 to force those clients offline, pushing users to upgrade to patched versions. Newer versions blocked the specific pop-up vector used in the phishing messages and introduced server blacklisting. Electrum creator Thomas Voegtlin stated that police investigations were initiated in Germany and the UK.","heading":"2018–2020: Large-Scale Phishing Campaign via Malicious ElectrumX Servers","severity":"critical","sources":[{"credibility":2,"name":"Bitcoin Wallet Exploit Has Caused $25 Million Stolen to Date — Decrypt","type":"news_article","url":"https://decrypt.co/44725/bitcoin-wallet-exploit-25-million-stolen-electrum"},{"credibility":2,"name":"Rapidly Growing Electrum Botnet Infects Over 152,000 Users; Steals $4.6 Million — The Hacker News","type":"news_article","url":"https://thehackernews.com/2019/04/electrum-bitcoin-wallet-botnet.html"},{"credibility":2,"name":"Hackers use fake software updates to steal millions from Electrum users — The Block","type":"news_article","url":"https://www.theblock.co/linked/80567/criminals-steal-22-million-through-electrum-phishing-updates"},{"credibility":2,"name":"Fake wallet update steals 1400 Bitcoin ($16 million) from Electrum user — HackRead","type":"news_article","url":"https://hackread.com/fake-wallet-update-steals-bitcoin-from-electrum-user/"},{"credibility":2,"name":"Electrum Bitcoin wallets under siege — Malwarebytes","type":"news_article","url":"https://www.malwarebytes.com/blog/news/2019/04/electrum-bitcoin-wallets-under-siege"},{"credibility":2,"name":"Bitcoin wallet Electrum hit by DoS attack from 140,000-strong botnet — The Next Web","type":"news_article","url":"https://thenextweb.com/news/bitcoin-wallet-electrum-dos-attack-botnet-phishing"}]},{"content":"Security firm Unciphered disclosed a remote code execution (RCE) vulnerability affecting Electrum. Eric Michaud, co-founder of Unciphered, described it as the most significant vulnerability his team had disclosed, stating it 'could have caused a lot of trouble' if exploited by a malicious actor. The specific technical details and the precise version range affected were not fully detailed in available public reporting at the time of this investigation. Electrum's continued active maintenance means that users running current versions are less likely to be affected by unpatched legacy flaws; however, the full scope of this disclosure warrants monitoring as further details emerge.","heading":"Remote Code Execution Vulnerability Disclosed by Unciphered","severity":"high","sources":[{"credibility":2,"name":"Two Novel Crypto Wallet Exploits, Explained — Immunefi / Medium","type":"research","url":"https://medium.com/immunefi/two-novel-crypto-wallet-exploits-explained-98e74e50d13f"}]},{"content":"The official Electrum documentation explicitly warns that attackers continue to create counterfeit websites, purchase Google Search advertisements using the 'Electrum' keyword, and distribute malware-laced installers via those channels. The official project does not purchase Google ads; any paid search advertisement promoting an Electrum download should be treated as suspicious. The documentation also identifies clipboard-hijacking malware — software that silently replaces a copied Bitcoin address with an attacker-controlled address before the user pastes it — as an active threat vector affecting Electrum users. Social engineering attacks, where scammers impersonate Electrum support staff on forums and request seed phrases or direct victims to malicious links, are also documented. These risks are not unique to Electrum but are amplified by its brand recognition and the high-value users it tends to attract.","heading":"Ongoing Risk: Fake Clones, Typosquatting, and Malicious Google Ads","severity":"medium","sources":[{"credibility":1,"name":"Malware and avenues of losing money — Official Electrum Documentation","type":"official","url":"https://electrum.readthedocs.io/en/latest/malware.html"},{"credibility":2,"name":"Electrum Bitcoin wallet still plagued by known crypto phishing attack — CoinTelegraph","type":"news_article","url":"https://cointelegraph.com/news/electrum-bitcoin-wallet-still-plagued-by-known-crypto-phishing-attack"}]},{"content":"Notwithstanding the incidents described above, Electrum's core architecture has several meaningful security properties. The wallet is non-custodial: private keys are generated locally and never transmitted to any server. The software is fully open-source under the MIT License and has been continuously reviewed by the Bitcoin developer community since 2011. Electrum supports hardware wallet integration (Trezor, Ledger, KeepKey), which moves key material entirely off the host machine. Multisignature wallet configurations are natively supported, offering an additional layer of protection. GPG signature verification of release binaries is available and documented. The wallet encrypts wallet files at rest when a password is set. The critical vulnerabilities and phishing losses documented above largely affected users running outdated versions, users who did not verify download sources, and users who did not use password protection or hardware wallet integration. Current versions include mitigations against the specific pop-up phishing vector used in the 2018–2020 campaigns.","heading":"Security Architecture and Mitigating Factors","severity":"low","sources":[{"credibility":1,"name":"Electrum Official Website","type":"official","url":"https://electrum.org/"},{"credibility":2,"name":"Electrum Wallet Review 2026 — CryptoNews","type":"news_article","url":"https://cryptonews.com/reviews/electrum-wallet-review/"}]}],"sources_used":[{"credibility":1,"name":"Electrum Official Website","type":"official","url":"https://electrum.org/"},{"credibility":1,"name":"Malware and avenues of losing money — Official Electrum Documentation","type":"official","url":"https://electrum.readthedocs.io/en/latest/malware.html"},{"credibility":1,"name":"GitHub — spesmilo/electrum","type":"official","url":"https://github.com/spesmilo/electrum"},{"credibility":1,"name":"CVE-2018-1000022 — CVEdetails","type":"other","url":"https://www.cvedetails.com/cve/CVE-2018-1000022/"},{"credibility":2,"name":"Bitcoin Wallet Exploit Has Caused $25 Million Stolen to Date — Decrypt","type":"news_article","url":"https://decrypt.co/44725/bitcoin-wallet-exploit-25-million-stolen-electrum"},{"credibility":2,"name":"Rapidly Growing Electrum Botnet Infects Over 152,000 Users; Steals $4.6 Million — The Hacker News","type":"news_article","url":"https://thehackernews.com/2019/04/electrum-bitcoin-wallet-botnet.html"},{"credibility":2,"name":"Hackers use fake software updates to steal millions from Electrum users — The Block","type":"news_article","url":"https://www.theblock.co/linked/80567/criminals-steal-22-million-through-electrum-phishing-updates"},{"credibility":2,"name":"Bitcoin wallet Electrum hit by DoS attack from 140,000-strong botnet — The Next Web","type":"news_article","url":"https://thenextweb.com/news/bitcoin-wallet-electrum-dos-attack-botnet-phishing"},{"credibility":2,"name":"Electrum Bitcoin wallets under siege — Malwarebytes","type":"news_article","url":"https://www.malwarebytes.com/blog/news/2019/04/electrum-bitcoin-wallets-under-siege"},{"credibility":2,"name":"Fake wallet update steals 1400 Bitcoin ($16 million) from Electrum user — HackRead","type":"news_article","url":"https://hackread.com/fake-wallet-update-steals-bitcoin-from-electrum-user/"},{"credibility":2,"name":"Electrum calls out copycat site Electrum Pro for 'bitcoin-stealing malware' — CoinGeek","type":"news_article","url":"https://coingeek.com/electrum-calls-copycat-site-electrum-pro-bitcoin-stealing-malware/"},{"credibility":2,"name":"Electrum Bitcoin wallet still plagued by known crypto phishing attack — CoinTelegraph","type":"news_article","url":"https://cointelegraph.com/news/electrum-bitcoin-wallet-still-plagued-by-known-crypto-phishing-attack"},{"credibility":2,"name":"Electrum Bitcoin Wallets Were Vulnerable to Hackers for Two Years — Vice/Motherboard","type":"news_article","url":"https://www.vice.com/en/article/electrum-bitcoin-wallets-were-vulnerable-to-hackers-for-two-years-json-rpc/"},{"credibility":2,"name":"Electrum patches a critical flaw that exposed Bitcoin Wallets to hack since 2016 — Security Affairs","type":"news_article","url":"https://securityaffairs.com/67591/digital-id/electrum-wallet-flaw.html"},{"credibility":2,"name":"Two Novel Crypto Wallet Exploits, Explained — Immunefi / Medium","type":"research","url":"https://medium.com/immunefi/two-novel-crypto-wallet-exploits-explained-98e74e50d13f"},{"credibility":2,"name":"Electrum Wallet Review 2026 — CryptoNews","type":"news_article","url":"https://cryptonews.com/reviews/electrum-wallet-review/"}],"summary":"Electrum is an open-source, non-custodial Bitcoin wallet first released in November 2011 by Thomas Voegtlin and maintained by Electrum Technologies GmbH. It is widely regarded as one of the most feature-rich and long-standing Bitcoin desktop wallets, but has been the persistent target of large-scale phishing campaigns exploiting its open peer network architecture, resulting in more than $25 million in user losses documented between 2018 and 2020.","timeline":[{"date":"2011-11-01","event":"Electrum Bitcoin wallet first released by Thomas Voegtlin.","source":"Electrum Official Website","source_url":"https://electrum.org/"},{"date":"2013-01-01","event":"Electrum Technologies GmbH incorporated to develop and distribute the Electrum software.","source":"Electrum Official Website","source_url":"https://electrum.org/"},{"date":"2016-03-01","event":"Electrum 2.6 released, inadvertently introducing the JSONRPC missing-authorization vulnerability (CVE-2018-1000022) that would remain undetected for nearly two years.","source":"Security Affairs","source_url":"https://securityaffairs.com/67591/digital-id/electrum-wallet-flaw.html"},{"date":"2017-11-01","event":"User 'jsmad' privately reports the JSONRPC vulnerability to Electrum developers.","source":"Vice/Motherboard","source_url":"https://www.vice.com/en/article/electrum-bitcoin-wallets-were-vulnerable-to-hackers-for-two-years-json-rpc/"},{"date":"2018-01-01","event":"Electrum releases version 3.0.4 attempting to patch the JSONRPC vulnerability; patch found to be incomplete. Version 3.0.5 fully addresses the flaw.","source":"CVEdetails — CVE-2018-1000022","source_url":"https://www.cvedetails.com/cve/CVE-2018-1000022/"},{"date":"2018-02-09","event":"CVE-2018-1000022 publicly disclosed with CVSS 3.0 score of 5.3 (Medium).","source":"CVEdetails — CVE-2018-1000022","source_url":"https://www.cvedetails.com/cve/CVE-2018-1000022/"},{"date":"2018-05-11","event":"Electrum team publicly exposes Electrum Pro, a copycat service at electrum.com distributing seed-stealing malware in Windows and macOS binaries.","source":"CoinGeek","source_url":"https://coingeek.com/electrum-calls-copycat-site-electrum-pro-bitcoin-stealing-malware/"},{"date":"2018-12-27","event":"First public reports of phishing attacks via malicious ElectrumX servers; approximately 200 BTC (near $1 million) stolen in initial wave.","source":"Decrypt","source_url":"https://decrypt.co/44725/bitcoin-wallet-exploit-25-million-stolen-electrum"},{"date":"2019-04-01","event":"Electrum botnet (ElectrumDoSMiner) reaches over 152,000 infected hosts. Cumulative losses at this stage reported at approximately $4.6 million. Attackers pivot to DDoS against legitimate Electrum servers to force older clients onto malicious nodes.","source":"The Hacker News","source_url":"https://thehackernews.com/2019/04/electrum-bitcoin-wallet-botnet.html"},{"date":"2020-08-01","event":"A single user reportedly loses 1,400 BTC (approximately $15.8 million at the time) via the fake-update phishing scheme.","source":"HackRead","source_url":"https://hackread.com/fake-wallet-update-steals-bitcoin-from-electrum-user/"},{"date":"2020-09-01","event":"Cumulative phishing losses attributed to the multi-year campaign estimated at over $25 million (approximately 1,980 BTC) by investigative reporting.","source":"Decrypt","source_url":"https://decrypt.co/44725/bitcoin-wallet-exploit-25-million-stolen-electrum"},{"date":"2025-09-20","event":"Electrum version 4.6.2 released, with continued active maintenance.","source":"Electrum Wallet Review 2026 — TradersUnion","source_url":"https://tradersunion.com/best-crypto-wallets/electrum-wallet/"}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 4cb8a7b6-4bf7-4699-b70e-b37eb022d7e8copy