The Bitcoin privacy wallet Sparrow Wallet has released version 2.5.4. Developer Craig Raw told Decrypt that most of the fixes in this update came from an AI-assisted code review focused on identifying potential vulnerabilities and reducing the wallet’s reliance on external services.
Inspections accelerated after the Coldcard incident
Raw stated that one of the backgrounds for this round of review is the July vulnerability in Coldcard’s seed generation code, which allowed attackers to reconstruct private keys without physical access to the device. Coinkite, the manufacturer of Coldcard, previously suggested that attackers may have used AI to discover this flaw.
He also mentioned that another reason driving this review is that new-generation AI tools can now search large codebases for potential vulnerabilities. Raw did not disclose which specific models Sparrow used, but stated that most of the fixes in this release resulted from this round of review.
Transaction verification has become a key focus area for updates.
According to the official update log, version 2.5.4 introduced multiple security checks related to transaction confirmation, primarily to reduce reliance on a single external blockchain data service by the wallet.
- Verify that the transaction returned by the Electrum server matches the request.
- Cryptographic proof that the transaction has been written into a Bitcoin block
- Verify the latest on-chain block before displaying transaction confirmation.
Hardware wallet synchronization strengthened with Tor protection
The new version also enhances the security requirements for the BitBox02. Sparrow now requires the device firmware to be at least version 9.4.0 and mandates anti-klepto protection to prevent the device from secretly leaking private key information during signing.
In addition to BitBox02, the update also includes support for Ledger, Trezor, Keycard, multisig wallets, Payjoin, wallet import, and partially signed Bitcoin transactions. Meanwhile, Sparrow has redacted Bitcoin Core credentials and other sensitive information from debug logs, restricted access to wallet and backup directories, and fixed a local DNS leak issue when using Tor.
Raw stated that this audit did not uncover any issues sufficient to put user funds at direct risk, nor was there evidence that such issues had been exploited. However, he still recommended users install this update. More broadly, AI is increasingly being used by Bitcoin developers to scan wallets, payment protocols, and codebases for potential vulnerabilities.