475 Electrum Titles Are a Web Footprint, Not a Wallet Census
Electrum is primarily a desktop wallet, so a web search count will not resemble a count of installed wallets. That mismatch is the point of an exposure exercise. A visible Electrum page may be a service, a documentation mirror, a merchant integration or a site copied from a template. The owner and the underlying key material determine the risk.
On 28 October 2026, ZoomEye returned 475 assets for title="Electrum" with sub_type=all. The app="Electrum" query returned 0. These results describe indexed HTTP content with the product name in the title, not the number of Electrum wallets on the internet.
Why a wallet integration is still worth inventorying
CVE-2026-117603 affects Electrum before 4.7.2. A malicious Nostr Wallet Connect client can exceed the configured daily spending limit because of a non-atomic budget check and a millisatoshi truncation issue. The integration may be used by an automation service, support workflow or merchant application that does not look like a traditional wallet.
A title match can lead to that application owner. Review the page for signs that it provides payment instructions, wallet downloads, a merchant checkout or an administrative interface. Do not assume the page itself holds a wallet. Contact the owner and ask whether Electrum or an NWC bridge is used behind the site.
Investigate the service, not the landing page
Start with the wallet version and the presence of the NWC plugin. Confirm whether the plugin is enabled, which clients hold a connection and what daily_limit_sat is configured. A high limit with a shared secret may matter more than a public marketing page.
Upgrade to 4.7.2 or later and rotate the NWC secret. Test a small payment through the normal path and reconcile both satoshi and millisatoshi values. Disable stale clients and require an approval step for new connections. If the wallet is part of an automated treasury workflow, add a second limit at the payment service or signing boundary.
The application should reserve spending atomically. A client must not be able to pass a budget check, wait while a second request passes the same check, then send both payments. Log the reservation, committed amount, settlement result and client identity.
Resolve the public footprint carefully
A title match could be a legitimate copy of the Electrum documentation. It could also be a third-party site using the brand without an official relationship. Resolve the domain, certificate, WHOIS or organisational ownership through approved sources before contacting anyone. Do not expose a private wallet or ask a site operator to send credentials.
For an owned site, compare the external title with the application inventory and hosting configuration. Record the exact dork, scope and collection time. If the page is removed after remediation, keep the historical observation because a changed count may reflect indexing rather than the removal of a wallet service.
Build a wallet-specific control list
A useful review covers keys, connections, transaction limits and the software supply chain. Verify the Electrum binary source and signature, keep the wallet host isolated from ordinary browsing and document who can approve a payment. Use a dedicated low-value wallet for testing policy changes.
External search becomes valuable when it points to an owner who can answer those questions. A count of 475 pages is not a risk score, and a zero application fingerprint is not proof that no wallet integration exists. The durable output is a list of payment services, versions, connection owners and transaction limits.
Top comments (0)