Bitcoin Privacy Wallet Sparrow Issues Update After AI Flags Fixes

Privacy-focused Bitcoin wallet developer Sparrow Wallet released version 2.5.4 on Thursday after an AI-assisted code review that yielded most of the update’s fixes, developer Craig Raw told Decrypt.

Raw said the review was prompted primarily by the release of unrestricted Chinese AI models and the new ability to search large codebases for potential exploits. He did not identify the models used to review Sparrow.

The review followed a July attack involving a flaw in Coldcard’s seed-generation code. The vulnerability allowed an attacker to reconstruct private keys without accessing the physical devices. Coldcard manufacturer Coinkite said it believed AI may have helped the attacker find the flaw.

“Obviously, the Coldcard incident triggered a great deal of activity within the Bitcoin space itself, but it was really the sudden arrival of the capability to search large codebases for potential exploits,” Raw told Decrypt.

Asked which fixes came from Sparrow’s AI-assisted review, Raw said, “Most of them—it was the bulk of the work in this release.”

Launched in 2020, Sparrow Wallet offers several privacy and security tools, including coin control to choose which Bitcoin funds to spend, Tor support to help conceal users’ IP addresses, and hardware wallet and air-gapped signing support to keep private keys offline.

Sparrow’s official changelog lists dozens of security changes aimed at reducing trust in outside services. The wallet now confirms that transactions returned by Electrum servers—which provide blockchain data to Bitcoin wallets—are the ones requested. It also checks cryptographic proofs that transactions were recorded in a Bitcoin block and verifies the latest block in the chain before showing transactions as confirmed.

Version 2.5.4 also strengthens BitBox02 hardware-wallet security. It requires firmware version 9.4.0 or later and anti-klepto protection, which helps prevent a compromised device from secretly leaking private-key information while signing a transaction.

Other changes affect Sparrow’s handling of Ledger, Trezor and Keycard devices, multisignature wallets, Payjoin, wallet imports and partially signed Bitcoin transactions. The update also redacts Bitcoin Core credentials and other secrets from debug logs, restricts access to wallet and backup directories, and closes local DNS leaks when using Tor.

Raw said the number of changes did not mean users’ funds had faced an immediate threat.

“Nothing was found that was likely to put funds at risk,” he said, adding that he personally checked each issue.

“Every issue raised was carefully reviewed by myself, and multiple independent AI passes,” he said.

Raw said he had found no evidence that the issues were exploited or that Sparrow users were affected, and considered such exploitation unlikely. He nevertheless recommended installing the update, while acknowledging that users with air-gapped setups may be reluctant to make changes.

“I always want people to update, and I recommend it—but of course there are those who are perhaps running Sparrow on air-gapped computers who are reluctant to make any changes to their setup,” Raw said. “In these cases, I would encourage reading the changelog regardless to make an informed choice.”

Sparrow’s review is part of a broader AI security push across the Bitcoin ecosystem, with developers using the technology to scan wallets, payment protocols, and code libraries for flaws before attackers find them.