Sparrow Wallet, the privacy-focused Bitcoin wallet, released version 2.5.4 on Thursday following an AI-assisted code review that produced most of the update's fixes, developer Craig Raw told Decrypt.

Raw said the review was prompted primarily by the release of unrestricted Chinese AI models and the new ability to search large codebases for potential exploits. He did not identify which models were used to review Sparrow's code.

The review came after a July attack exploiting a flaw in Coldcard's seed-generation code, a vulnerability that allowed an attacker to reconstruct private keys without ever accessing the physical devices. Coldcard manufacturer Coinkite said it believed AI may have helped the attacker find the flaw. The incident illustrated how the same AI tooling that helps developers audit code can also lower the barrier for attackers hunting for vulnerabilities in widely used Bitcoin software.

"Obviously, the Coldcard incident triggered a great deal of activity within the Bitcoin space itself, but it was really the sudden arrival of the capability to search large codebases for potential exploits," Raw told Decrypt.

Asked which fixes in the release came out of the AI-assisted review, Raw answered: "Most of them—it was the bulk of the work in this release."

Launched in 2020, Sparrow Wallet offers a range of privacy and security tools, including coin control to choose which Bitcoin funds to spend, Tor support to help conceal users' IP addresses, and hardware wallet and air-gapped signing support to keep private keys offline.

According to the official changelog, version 2.5.4 includes dozens of security changes aimed at reducing trust in outside services. The wallet now confirms that transactions returned by Electrum servers—which provide blockchain data to Bitcoin wallets—are the ones actually requested. It also checks cryptographic proofs that transactions were recorded in a Bitcoin block and verifies the latest block in the chain before displaying transactions as confirmed. These changes matter because many Bitcoin wallets rely on third-party Electrum servers for blockchain data, and a malicious or compromised server could otherwise feed a wallet false transaction information.

The update also strengthens security for the BitBox02 hardware wallet, requiring firmware version 9.4.0 or later along with anti-klepto protection, which helps prevent a compromised device from secretly leaking private-key information while signing a transaction.

Additional changes affect Sparrow's handling of Ledger, Trezor, and Keycard devices, multisignature wallets, Payjoin, wallet imports, and partially signed Bitcoin transactions. The update further redacts Bitcoin Core credentials and other secrets from debug logs, restricts access to wallet and backup directories, and closes local DNS leaks that could occur when using Tor.

Raw emphasized that the volume of changes did not mean users' funds had faced an immediate threat. "Nothing was found that was likely to put funds at risk," he said, noting that he personally checked each issue.

"Every issue raised was carefully reviewed by myself, and multiple independent AI passes," Raw said.

He said he found no evidence that the issues had been exploited or that Sparrow users were affected, and considered such exploitation unlikely. He nevertheless recommended installing the update, while acknowledging that users with air-gapped setups may hesitate to change their configuration.

"I always want people to update, and I recommend it—but of course there are those who are perhaps running Sparrow on air-gapped computers who are reluctant to make any changes to their setup," Raw said. "In these cases, I would encourage reading the changelog regardless to make an informed choice."

Sparrow's review forms part of a broader AI security push across the Bitcoin ecosystem, with developers using the technology to scan wallets, payment protocols, and code libraries for flaws before attackers can find them. For users, the release also highlights a practical security habit: keeping wallet software current while verifying updates through official channels, since wallet distribution channels have themselves been targets of attacks in the broader crypto space.

Source: Decrypt