ok but i really want to understand
I dowload the source from electrum site.
I have read there was a DNS hack on electrum could it be that ?
it's electrum version 3.0.3 and earlier that have a vulnerability (possibly 3.0.4 too) so if you're using 3.0.5 and never used previous version you should be save from that.