wallet-backup: how security-sensitive? /

[joe1234]

Hello

1.
I created a new wallet in Electrum on Tails, swept the funds from a paper wallet into it, and then made a "wallet backup"
using the built-in "Create/Restore Wallet" function in Electrum.

The next day, I restored the Electrum wallet from this backup without needing to enter the 12-word seed.

Does this mean that if an intruder gains access to an Electrum wallet backup, he or she would have full control over my Bitcoin funds?



2. 
After restoring the wallet backup file (electrum_20250922_wallet), making an additional transaction, and saving the wallet 
using "Create/Restore Wallet," the backup file was smaller than it had been after the first transaction. 

Does this mean that when creating a new wallet backup with the same filename, all contents of the previous day’s backup were overwritten?


Thank you!

[Charles-Tim]

Create/Restore wallet is not a backup but a wallet that you have on your Electrum. But the wallet file is a backup. I prefer to use the seed phrase as the backup instead as I do not care about anything than my coins.

Does this mean that if an intruder gains access to an Electrum wallet backup, he or she would have full control over my Bitcoin funds?

Yes.

2. 
After restoring the wallet backup file (electrum_20250922_wallet), making an additional transaction, and saving the wallet 
using "Create/Restore Wallet," the backup file was smaller than it had been after the first transaction. 

Wallet files will just take a very small/minute space in your device memory and not worth thinking about.

[promise444c5]

In addition  to what’s above already,you should know it’sjust your wallet data .. Everytime you create a new wallet , Electrum store the data in a JSON format inside wallets folder in the AppData directory( not that straight forward though but you can easily check the path by trying to import one ).. You can use it as backup though, it has the ‘ keystore’ section which contains your seed, seed_type, extended keys (private and public) and other ..so it pretty much has everything to recover your wallet..

In most cases, seed is usually enough , but if you have stuffs customized on your electrum like transaction labels and likes that are only stored locally then  you can easily just recover everything using the wallet file instead of the seed.. If you have multiple wallets aswell, you can easily just backup everything by copying and encrypting the ‘wallets’  folder before storing it in a safe medium like drives unlike a seed which you can just easily write/ carve it  on different surfaces..

Does this mean that when creating a new wallet backup with the same filename, all contents of the previous day’s backup were overwritten?

No, because it’s same wallet..
How did you know it reduced though..there shouldn’t be that much difference either if it truly reduced(that shouldn’t be a concern imo), you will still get same wallet data in same file , it will only append additional datain the ‘addr_history’ stating the txid and the block height, since you mentioned you made a transaction .. if you added a label  on it, it would be recorded inside ‘labels’ so there’s even more chance of bigger files.. you might not understand these but if you open the file itself  you will get what I’m saying..

Note: you shouldn’t be messing around with it if that’s the only backup you have..although, you can easily copy your seed & other keys  but if you’ve touched them too and can’t possibly recover it then you’re cooked..

[nc50lc]

Does this mean that when creating a new wallet backup with the same filename, all contents of the previous day’s backup were overwritten?

Don't think too much of the contents and size since you've overwritten the file itself by using the same file name as the previous.
That's a normal behavior of every operating system, not exclusive to Electrum: Saving something to same directory and same file name of an existing file results with an overwrite.

The discrepancy in the size may be due to the queued "to-be-written" data in the first wallet file backup which must have been already fulfilled in the next wallet file backup.
The extra names such as 'operation' and 'path' add a few additional bytes to the wallet file.
However, the important data such as the keystore remains the same.

[UchihaSarada]

I created a new wallet in Electrum on Tails, swept the funds from a paper wallet into it, and then made a "wallet backup"
using the built-in "Create/Restore Wallet" function in Electrum.

This feature is making a copy of your original wallet file and it is different than making your wallet backup with wallet seed.

This method will store all information in that wallet for you like address labels for addresses in your wallet and addresses you sent your bitcoins to.
A second method with wallet seed that is used for wallet import later, will not give you address labels.

You can try practicing two methods and see differences by yourself.

The next day, I restored the Electrum wallet from this backup without needing to enter the 12-word seed.

You need to type your wallet file's password to oepn that encrypted wallet file.

You confused and misunderstood this step, which is not a wallet restoration or wallet recovery. You just open a wallet file that is your wallet backup file created before.

Does this mean that if an intruder gains access to an Electrum wallet backup, he or she would have full control over my Bitcoin funds?

Yes, if you let your computer compromised, the hacker can access both your original wallet file and the wallet backup file.

[Pmalek]

Make sure that your wallet is encrypted with a password. In that case, even if someone were to hack into your system and steal the backup file, they couldn't load it and see your keys without the password. The more complex and longer the password is, the more difficult to crack/brute force it.

If you use Electrum as a companion app for a hardware wallet, like Trezor, then your keys and the seed won't be saved in that backup wallet file. They will always remain on the Trezor. The data in the wallet file can only affect your privacy in that case but not the security of your coins.