You run Bitcoin Core. But is your wallet actually using it?

Here's a simple test I think more node runners should do:

Open the wallet you normally use and check which server it is actually talking to.

Running Bitcoin Core doesn't necessarily mean your wallet is using your node for wallet queries. Depending on the setup, you may still be querying a public Electrum server and sharing information about the scripts/transactions you're interested in.

I ended up turning this into a practical audit rather than another “run your own node” guide.

It covers how to:

• inspect the wallet's actual connections
• check listening ports with ss
• distinguish Bitcoin P2P from RPC exposure
• audit electrs, Fulcrum and ElectrumX
• catch Docker port publishing
• check IPv6 instead of assuming NAT protects you
• test the ports externally
• use SSH/VPN/Tor instead of exposing a personal Electrum server
• use tcpdump to verify where the wallet connection actually goes

I also went back to this because someone here pointed out that I had left Electrum out of my previous self-hosting threat model. They were right.

Full guide is free:

https://davidebtc186.substack.com/p/your-bitcoin-wallet-is-talking-to

I'd be interested in what people here actually use: Core directly, electrs, Fulcrum, ElectrumX, or a public server?