Electrum Wallet: Safe Download, Signature Check and Phishing Risks

Electrum is a free, open-source Bitcoin wallet for desktop and Android, first released by Thomas Voegtlin in November 2011 and still maintained today. The current version is 4.8.2, a security update released on 11 September 2026. Download it only from electrum.org and check the GPG signature before you run it: fake Electrum builds and fake update pop-ups have cost users thousands of bitcoins.

Below we explain what Electrum does, how to download and verify it step by step, how its seed phrases differ from other wallets, how fees and hardware wallets work in it, and the phishing attacks every Electrum user should know about. All product facts come from electrum.org, the Electrum documentation and the project’s own release notes.

What Electrum is and how it works

Electrum is a light wallet. Instead of downloading the whole blockchain like Bitcoin Core, it connects to a network of public Electrum servers and checks your transactions with SPV (simplified payment verification) proofs. That makes it quick to start on almost any computer.

Your private keys are encrypted and stay on your device. The servers see your addresses and transactions, but they never hold your keys and cannot spend your coins. Electrum also supports cold storage (keys on an offline machine, a watching-only copy online), multisig wallets, two-factor wallets through the TrustedCoin plugin, and Lightning payments.

The software is MIT-licensed. Electrum Technologies GmbH, a Berlin company Voegtlin founded in 2013, develops, packages and distributes it. Electrum is Bitcoin-only: projects with similar names for other coins are separate. Our Bitcoin guide covers the network basics.

Official download options

Everything is on the download section of electrum.org. Each file has a matching .asc signature file next to it.

No iPhone version is listed on electrum.org, so treat any iOS app using the Electrum name with caution.

How to verify the Electrum signature

The electrum.org homepage carries a warning in its header: do not download Electrum from any source other than electrum.org, and verify GPG signatures. Checking a signature proves the file was built and signed by the developers and was not swapped on the way to you. It takes about five minutes the first time.

1. Install GnuPG. Gpg4win on Windows, GPG Suite or Homebrew’s gnupg on macOS; most Linux distributions include it.
2. Get the signing keys. The Electrum repository on GitHub keeps them in its pubkeys folder (ThomasV.asc, sombernight_releasekey.asc, Emzy.asc and others). Import one or more with gpg –import ThomasV.asc.
3. Download the binary and its .asc file from electrum.org into the same folder.
4. Run the check: gpg –verify electrum-4.8.2.exe.asc electrum-4.8.2.exe (use your actual file name).
5. Read the result. You want “Good signature from” followed by a developer’s name, and a key fingerprint that matches the published one. For ThomasV that is 6694 D8DE 7BE8 EE56 31BE D950 2BD5 824B 7F94 70E6.

GnuPG will also print “This key is not certified with a trusted signature”. The Electrum documentation says you can ignore that line: it only means you have not personally signed the developer’s key. What you must not ignore is “BAD signature” or a fingerprint that differs. Delete the file in either case.

The current release lists five signers: ThomasV, SomberNight, Emzy, felixb_f321x and svanstaa. A file signed by any of them checks out, so a missing signature from one person is not a problem.

Seed phrases: Electrum’s own format

When you create a wallet, Electrum shows a 12-word seed. It looks like a BIP39 phrase but is not one. Electrum’s documentation explains the reason: BIP39 phrases carry no version number, so a wallet cannot tell which derivation method created them. Electrum seeds embed a version prefix derived from a hash of the phrase, which also catches typos.

Two practical consequences follow. First, an Electrum seed usually will not restore correctly in a phone wallet that expects BIP39, so write “Electrum seed” next to the words on your backup. Second, Electrum works the other way round: it can import a BIP39 phrase from another wallet if you tick the BIP39 option during restore. You can also add a seed extension (a passphrase) for extra protection, which must be backed up separately.

Our wallet overview explains recovery phrases in general and how to store them offline.

Fees and replace-by-fee

Electrum gives fine control over fees. You can set a rate per virtual byte, pick coins manually from the Coins tab, and batch payments. If a transaction is stuck because the fee was too low, the Bump fee option rebuilds it with a higher fee using replace-by-fee (RBF). Release 2.7.0 (October 2016) brought RBF support to both the desktop and Android apps.

A worked example: you send 0.015 BTC with a fee of 2 sat/vB on a 141-vbyte transaction, paying 282 sats. A day later it is still unconfirmed because blocks are clearing at 9 sat/vB. Bumping to 10 sat/vB raises the total fee to 1,410 sats, and the replacement can confirm in the next few blocks. The recipient and amount stay the same.

Using Electrum with a hardware wallet

Electrum is a popular desktop interface for hardware wallets. The keys stay on the device, and Electrum builds the transaction, shows the history and handles fees. The source tree includes plugins for:

• Ledger and Trezor
• Coldcard and BitBox02
• Blockstream Jade and KeepKey
• Safe-T and the older Digital Bitbox

On Linux you may have to add the udev rules your device maker publishes before Electrum can see the device. If you still use a Ledger Nano S, check that its Bitcoin app is current first: Ledger declared that model end of life in June 2022.

Known phishing attacks on Electrum users

Electrum’s open server network is a strength, because anyone can run a server and nobody controls access. It was also the route for the best-known attack on the wallet.

On 26 December 2018 Electrum developer SomberNight opened GitHub issue 4968. Attackers had set up dozens of malicious servers. When a user tried to broadcast a transaction through one of them, the server returned an “error” formatted as rich text, telling the user to install an urgent update from a link. The download was malware dressed up as Electrum.

The developers responded in stages. Release 3.2.4 (30 December 2018) backported anti-phishing measures, and 3.3.3 (25 January 2019) stopped showing server error messages to users altogether. Old versions remained exposed, though, and the trick kept working. In October 2020 ZDNet traced about ten Bitcoin addresses used in the fake-update scam holding 1,980 BTC, on top of 202 BTC it had reported in December 2018. One victim alone reported losing 1,400 BTC in August 2020 after installing a fake update.

The fake builds had a tell. On start-up they asked for a two-factor one-time code, which genuine Electrum requests only when you send. Entering it let the malware empty the wallet.

Defend yourself with a few habits:

• Update only by downloading from electrum.org and verifying the signature, never from a link shown inside the app or in an email.
• Keep Electrum current, because older versions lack the server-message fix.
• Be wary of search ads and lookalike domains offering Electrum downloads.
• Never type your seed into a website or a “support” chat.
• For larger balances, pair Electrum with a hardware wallet so a compromised computer still cannot sign without your approval on the device.

Lightning in Electrum

Since version 4.0.5 (November 2020) Lightning has been enabled by default, though Electrum does not connect to the Lightning Network until you open a channel. Channels need separate care: the release notes say Lightning funds cannot be fully restored from the seed alone, so export channel backups. The 4.8.2 notes also flag that some older backups for anchor channels lack a key needed to sweep coins after a force-close, and affected wallets show a warning asking you to export new ones.

Electrum alternatives

If Electrum does not suit you, three other Bitcoin options are common. Bitcoin Core is the reference full node and wallet, heavier but trusting no server. Sparrow is a desktop wallet built around coin control and hardware devices. Mobile users often prefer a phone-first app. If you need several coins in one place, Electrum is the wrong tool: see the multi-coin options on our wallets page. For buying the bitcoin in the first place, our exchange comparison covers custody and fees, and our Kraken review looks at one regulated option.

What changed since our old Electrum page

The earlier page called Electrum a beginner wallet with a 12-word backup and listed its features without a word on where to download it safely. We have added signature verification, the seed-format caveat, Lightning backups and the documented phishing history, and dropped the old praise of the public server network as a reliability feature. Servers are exactly where attackers have struck.