Fact-check findings
What an automated fact-checker found when it re-read Electrum against the sources the page cites. Only the most recent review is shown.
These findings are produced by an automated reviewer, and its results vary between runs: the same page, checked three times on the same day, came back with 15%, 20% and 34% of its claims disputed, mostly because each run extracted a different number of claims. Treat what follows as leads, not rulings.
“Disputed” means the reviewer could not reconcile the claim with the evidence it cited. It does not mean the claim is false. “Unverifiable” means no reachable source settled it either way.
Nothing here changes the page on its own. A proposed correction is applied only after a human moderator approves it; until then the page reads as it did when reviewed.
unverifiable
2 claimsNo source the reviewer could reach confirms or contradicts the claim.
- #2[unverifiable][awaiting moderator]in the timeline
“Electrum version 4.6.2 released, with continued active maintenance.”
reviewerElectrum 4.6.2 released 2025-09-20The cited TradersUnion source is not in sources_used and I did not verify the release date. The GitHub releases page showed no releases. - #6[unverifiable][awaiting moderator]in section: 2016–2018: JSONRPC Missing Authorization Vulnerability (CVE-2018-1000022)
“CVE-2018-1000022 was published on February 9, 2018, and carries a CVSS 3.0 base score of 5.3 (Medium).”
reviewerCVE-2018-1000022 published February 9, 2018, CVSS 3.0 base score 5.3 (Medium)I could not read the NVD or CVEdetails records. The page also calls the flaw 'critical' while citing a Medium CVSS score, which is an internal tension, and the claim is left unscored.
stale
1 claimThe claim was accurate when written but events since have overtaken it.
- #1[stale][awaiting moderator]in section: Background and Overview
“As of late 2025, the current release is version 4.6.2.”
reviewerCurrent release is version 4.6.2 as of late 2025The page is dated 'late 2025' but newer releases (4.8.0 to 4.8.3) exist. The 4.8.3 figure rests on one secondary source.Proposed correction (not yet applied)As of October 2026, the current release is version 4.8.3.citedelectrum.org/
partially supported
1 claimThe cited evidence supports part of the claim but not all of it.
- #3[partially supported][awaiting moderator]in section: 2018–2020: Large-Scale Phishing Campaign via Malicious ElectrumX Servers
“ZDNet/Decrypt investigations estimated the cumulative total at approximately 1,980 BTC ($22–25 million) as of late 2020.”
reviewerCumulative phishing losses over $25 million (about 1,980 BTC) per Decrypt; 1,400 BTC single victim in late August 2020; police investigations in Germany and the UKThe core figures match. The timeline date 2020-09-01 for the cumulative estimate is earlier than the Decrypt publication date of October 2020.
confirmed
2 claimsThe cited evidence supports the claim as written.
- #4[confirmed][no action needed]in the timeline
“Electrum botnet (ElectrumDoSMiner) reaches over 152,000 infected hosts.”
reviewerBotnet over 152,000 hosts and $4.6M by April 2019The source is dated 2019-04-30 and the timeline says 2019-04-01. That is within the month, but the date is imprecise. - #5[confirmed][no action needed]in the summary
“resulting in more than $25 million in user losses documented between 2018 and 2020.”
reviewerSummary: more than $25 million in losses documented between 2018 and 2020Matches Decrypt.