Running your own Bitcoin node doesn't automatically mean your wallet is actually using it.
So here's a small experiment:
Open the wallet you use every day.
Find its server/backend settings.
Who owns that machine?
I went deeper and turned this into a practical privacy audit: actual wallet connections, Electrum queries, electrs vs Fulcrum vs ElectrumX defaults, Bitcoin RPC, Docker ports, IPv6, Tor, SSH/VPN tunnels and external port testing.
There's also a simple tcpdump test to see where the wallet connection really goes instead of trusting the settings screen.
The rabbit hole started because someone pointed out that I'd missed Electrum in my previous self-hosting threat model.
They were right.
So I audited the layer separately.
Full thing is free:
https://davidebtc186.substack.com/p/your-bitcoin-wallet-is-talking-to
If you run your own backend, what are you using — electrs, Fulcrum, ElectrumX or Core directly?
I had not thought much about this before. Running your own node sounds private but it does not help much if your wallet is still talking to a public server. I think checking where the wallet is actually connecting is probably something more people should do.
I use Electrs.
The risks of exposing your xpub to random nodes is not talked about enough.
I used to think "I run a node" meant "I'm private," until I realised my wallet may have been requesting someone else's server the entire time without my knowledge. That is exactly why self-custody is important to me: it is more than simply keeping my own keys; it is about confirming my complete stack, including what my wallet is actually communicating with, rather than relying on a settings page. Running the node is the first step for me; auditing the connection is what makes it genuine.