Electrum

Is Electrum safe?

Electrum is one of the most capable Bitcoin wallets you can run on a computer, and its code is about as open as it gets. It has been around since November 2011, the Android build is verified as reproducible, and it supports multisigMultisigA crypto wallet that needs approval from several keys to move funds, for example any 2 of 3, rather than from a single key.More in the glossary, hardware walletsHardware walletA small dedicated device that stores crypto private keys offline and signs transactions inside the device, so the keys never touch your computer.More in the glossary and offline signing. We score it 69/100, a C.

The low part is its history. In 2018 and 2019 attackers used a weakness in the official client to show users fake update messages, and Malwarebytes estimated the resulting thefts at more than 771 BTC. Nobody was repaid. Electrum is a sound tool today, but it rewards users who know how to use it carefully.

The 2018–2019 fake-update attack

Electrum does not download the whole blockchain; it asks public Electrum servers, which anyone can run. When the wallet broadcast a transaction and a server returned an error, versions before 3.3.3 displayed that error text as rich text, with clickable links.

In December 2018 an attacker started running many such servers on different IP ranges so that clients would connect to them. When a user tried to send bitcoin, the malicious server replied with an "error" saying the wallet needed a security update, plus a download link. The download was malware dressed as Electrum, and one variant uploaded the user's seed to the attacker. Electrum's developers were sent a screenshot of the message on 21 December 2018, quietly shipped a mitigation within hours and published the details on 26 December.

The fixes came quickly. Version 3.3.2 (21 December 2018) showed server errors as plain text with a warning in front. Version 3.3.3 (25 January 2019) stopped showing server error messages at all and added signed release notices that the client verifies. A botnet then attacked legitimate Electrum servers with denial-of-service traffic, which Malwarebytes said pushed old, unpatched clients towards the malicious servers.

By April 2019 Malwarebytes estimated the thefts at more than 771 BTC, about $4 million at the time. The theft needed the user to install the fake update, but it came through Electrum's own client, which showed untrusted text it should have filtered. Our rubric counts that, and large losses that were never repaid put the security record at 48.

How Electrum stores your keys

Electrum creates a seed on your device and keeps the wallet file encrypted with your password. You can view the seed whenever you want and restore it elsewhere. Beyond that, few software wallets offer as much: an optional seed extension (an extra word only you know), multisigMultisigA crypto wallet that needs approval from several keys to move funds, for example any 2 of 3, rather than from a single key.More in the glossary wallets that need several keys to spend, support for Trezor, Ledger, Coldcard, BitBox02 and other hardware, and a cold-storage setup where an offline computer signs and an online one only broadcasts.

Our rubric caps software wallets at 84 for key management because keys on an internet-connected computer can be reached by malware. Electrum scores 83. Used with a hardware wallet such as Trezor or in its offline-signing mode, the key never touches the online machine at all.

Is Electrum open source and audited?

Yes to open source, no to a public audit. The code has been on GitHub under the MIT licence for more than a decade, releases are signed by the developers, and WalletScrutiny reports that the Android app passed all its tests, including a reproducible build from the public source. Security fixes are disclosed in release notes and GitHub advisories. In 2026 alone, versions 4.7.2 to 4.8.2 shipped fixes for reported issues, including a medium-severity plugin bypass that allowed local code execution.

We found no published third-party audit, and Electrum runs no paid bug bounty; researchers report through GitHub or by email to the developers. Transparency scores 78.

What Electrum protects you from, and what it does not

Electrum handles only bitcoin, so the token-approval drainersDrainerA malicious website or script that tricks a crypto user into signing a transaction or approval that lets attackers empty the wallet.More in the glossary that empty MetaMask wallets do not apply. Before you sign, it shows the outputs, amounts and fee, and since 2025 it can avoid spending tiny "dust" deposits sent to track you.

What it lacks is any warning about phishing sites or suspicious addresses. Electrum's own documentation lists the real risks: fake copies of the wallet advertised on Google, clipboard malware that swaps the address you paste, and a compromised computer that reads the wallet file. Scam protection scores 65.

How to stay safe with Electrum

1. Download only from electrum.org and verify the GPG signature. Never install Electrum from an ad or a link in a pop-up.
2. Set a strong wallet password and write the seed on paper or metal.
3. After pasting an address, compare the first and last characters with the original.
4. For savings, pair Electrum with a hardware walletHardware walletA small dedicated device that stores crypto private keys offline and signs transactions inside the device, so the keys never touch your computer.More in the glossary or use offline signing.
5. Connect through Tor or your own server if you do not want public servers to see your addresses.

How we scored it

Key management (83) and the company record (82) are Electrum's strongest factors: a well-designed software wallet from an identifiable developer that collects almost nothing. The security record (48) is the weakest, because the 2018–2019 phishing campaign ran through the official client and the stolen coins were never returned. Exodus scores higher on its cleaner record, though Electrum gives you far more control over your keys.