TCP 50002
Synopsis
- TCP port 50002 is widely used by the Electrum protocol for SSL/TLS connections between Bitcoin wallets and Electrum servers.
- Real software that listens on 50002 includes ElectrumX, Electrs, Fulcrum, and Electrum Personal Server; many setups (e.g., BTCPay Server, Umbrel, RaspiBolt) expose their Electrum server on 50002.
- Wallets that connect to servers on 50002 include Electrum, Sparrow, and BlueWallet (when configured to use a remote Electrum server).
- This port has been associated with exploitation: attackers have run malicious Electrum servers on 50002 to push fake “update” messages, leading users to install malware and steal funds, and have also DDoS’d Electrum infrastructure.
Observed activity
Last 30 days
Detailed chart