Product record · Electrum

Electrum

multi_platform_appactivenot_applicablesupported

Single long-lived Electrum software lineage distributed across desktop operating systems and Android.

Launch
2011
Sales
not_applicable
Support
supported
Variants
—
Confidence
high
Last verified
2026-08-14

Material concerns

Custody and recovery assumptions

Active support, evidence verification, or product type is not a safety endorsement. Missing custody or recovery metadata is shown as unknown rather than inferred as self-custody.

Custody model
self_custody
Key-management model
locally_encrypted_seed_and_private_keys
Independent recovery
Unknown / requires evidence review
Material lifecycle / security events
Relevant event recorded in the canonical timeline

Lifecycle

Product timeline

2011
launched

Electrum created

Product: Electrum

Thomas Voegtlin created Electrum in 2011; the project has remained in continuous development as a lightweight Bitcoin wallet.

Evidence: 1
2026-04-02
software_fixmedium

Electrum 4.7.2 released with plugin security fixes

Product: Electrum

Electrum 4.7.2 was released with fixes for the external-plugin authorization bypass and the Nostr Wallet Connect daily spending-limit bypass later documented in the project security advisories.

Scope: softwareFunds affected: unknownAction: updateEvidence: 2
2026-04-28
vulnerability_disclosedmedium

External plugin authorization bypass disclosed

Product: Electrum

Electrum disclosed an external-plugin authorization bypass that could allow a rogue local process with filesystem write access to the Electrum data directory to execute arbitrary plugin code inside Electrum. The official advisory states the external-plugin system was affected from Electrum 4.6.0 until the fix in 4.7.2.

Scope: softwareFunds affected: unknownAction: updateEvidence: 1
2026-04-28
vulnerability_disclosedlow

Nostr Wallet Connect spending-limit bypass disclosed

Product: Electrum

Electrum disclosed two flaws in its Nostr Wallet Connect plugin that could let a malicious or compromised NWC client spend above the configured daily limit through concurrent budget checks and millisatoshi truncation. The official advisory states the NWC plugin was affected from Electrum 4.6.0 until the fix in 4.7.2.

Scope: softwareFunds affected: unknownAction: updateEvidence: 1

Sources

Evidence