External risk intelligence

Electrum Nostr Wallet Connect Plugin Spending Limit Bypass

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-117603

The vulnerability exists within a specific plugin (Nostr Wallet Connect) for the Electrum desktop wallet. While network-reachable during active protocol communication, Electrum is primarily a client-side application running on local user devices. It is not typically deployed as an internet-facing service, edge gateway, or public-facing server, making public internet exposure uncommon in standard deployments.

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a vulnerability in the Nostr Wallet Connect plugin for the Electrum Bitcoin wallet. The issue allows malicious wallet connections to bypass daily spending limits, potentially leading to unauthorized fund withdrawals. The primary concern is to confirm if this specific plugin is in use within your organization.

A plugin flaw can bypass spending limits.
Consider if this specific plugin is used.
Confirm relevance and exposure to potential risks.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted payment requests to a vulnerable Electrum wallet. This could be achieved by interacting with the Nostr Wallet Connect plugin, which does not properly validate spending limits. Successfully exploiting this could allow an attacker to drain funds beyond the intended daily limit.

No special access required.
Concurrent, truncated payment requests.
Unauthorized fund withdrawal.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability in the Nostr Wallet Connect plugin for Electrum could allow a malicious client to bypass configured daily spending limits. This occurs when concurrent payment requests are made, or when very small amounts are repeatedly sent, potentially leading to unauthorized fund expenditure beyond the set limit.

User's cryptocurrency funds could be at risk.
Malicious NWC clients could exploit budget checks.
Funds could be drained beyond the daily limit.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Electrum wallet's Nostr Wallet Connect plugin is affected by a spending limit bypass vulnerability. This issue requires application owners and platform teams to identify instances of Electrum, determine their exposure, and plan remediation. The initial step involves locating all deployments, verifying business criticality and reachability, and assigning ownership for the response.

Application owners should address this.
Verify usage and identify affected instances.
Coordinate vendor fixes and schedule updates.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Electrum and the Nostr Wallet Connect plugin?

Electrum is a popular desktop Bitcoin wallet that lets users manage digital assets. It supports a plugin system, including Nostr Wallet Connect, which allows the wallet to bridge with other applications. This specific plugin enables external services to request payments from the wallet, essentially acting as an interface for decentralized messaging and payment protocols.

How does CVE-2026-117603 allow a spending limit bypass?

This vulnerability is a Time-of-Check to Time-of-Use (TOCTOU) race condition, categorized as CWE-367. It occurs because the plugin performs budget validation checks that are not atomic. When multiple payment requests arrive simultaneously, or when requests use tiny fractional amounts that the system rounds down, the wallet fails to correctly update or enforce the daily spending limit, allowing unauthorized transfers.

What triggers this vulnerability in Electrum?

The flaw is triggered when a connected Nostr client sends payment requests that exploit the timing gap between budget checks and actual execution. Notably, this bug does not trigger during standard, sequential wallet usage or when the Nostr Wallet Connect plugin is disabled. The issue specifically requires the interaction of concurrent requests or precise manipulation of millisatoshi values.

Is my Electrum wallet instance at risk according to Halo Surface Signal?

Halo Surface Signal indicates that exploitation is unlikely for most users because Electrum is a client-side application rather than a public-facing server. Because it is not typically exposed to the internet like a web service or gateway, the chances of an external attacker successfully connecting to your specific wallet plugin are low in standard configurations.

What steps should I take if I use the Nostr Wallet Connect plugin?

The most effective response is to verify if you have the Nostr Wallet Connect plugin enabled in your Electrum instance. If it is in use, locate your specific deployment and prepare to update the software to version 4.7.2 or later, where this budget check logic has been addressed. Coordinate with your team to audit any active connections associated with the plugin.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.