Sparrow Wallet pushes security release after AI-assisted code review Privacy-focused Bitcoin wallet Sparrow Wallet released version 2.5.4 on Thursday after an AI-assisted code review produced most of the update’s fixes, developer Craig Raw told Decrypt. Raw said the review was driven by two recent developments: the emergence of unrestricted Chinese AI models and the new ability to search large codebases for potential exploits. He declined to name the models used. The review was also prompted by a high-profile July incident in which a flaw in Coldcard’s seed-generation code allowed attackers to reconstruct private keys without physical access to devices—an exploit the Coldcard maker Coinkite said may have been found with AI help. “Obviously, the Coldcard incident triggered a great deal of activity within the Bitcoin space itself, but it was really the sudden arrival of the capability to search large codebases for potential exploits,” Raw told Decrypt. When asked which fixes came from the AI-assisted review, he said, “Most of them—it was the bulk of the work in this release.” What’s in 2.5.4 - Dozens of security-focused changes aim to reduce trust in external services and tighten local protections. - Electrum server interactions now confirm returned transactions match the requests, validate cryptographic proofs that transactions were recorded in a Bitcoin block, and verify the latest chain head before showing transactions as confirmed. - BitBox02 hardware-wallet support is hardened: Sparrow now requires BitBox02 firmware 9.4.0 or later and enforces anti-klepto protection to reduce the risk that a compromised device can leak private-key information during signing. - Other adjustments cover Ledger, Trezor and Keycard handling, multisignature wallets, Payjoin, wallet imports and partially signed Bitcoin transactions (PSBTs). - Debug logs now redact Bitcoin Core credentials and secrets; access to wallet and backup directories is more restricted; and Sparrow closes local DNS leaks when used over Tor. Context and recommendations Launched in 2020, Sparrow offers privacy and security tools such as coin control, Tor support and hardware-wallet and air-gapped signing to keep keys offline. Raw emphasized that the volume of fixes doesn’t imply an immediate danger to users’ funds: “Nothing was found that was likely to put funds at risk.” He said he personally reviewed each issue and ran “multiple independent AI passes,” finding no evidence any of the issues had been exploited or affected Sparrow users—an outcome he called unlikely. Still, Raw recommended users install the update. He acknowledged that some people running air-gapped setups may hesitate to change their environment and suggested they at least read the changelog to make an informed decision. Broader trend Sparrow’s AI-assisted review reflects a wider shift in the Bitcoin developer community: teams are increasingly using AI tools to scan wallets, payment protocols and code libraries for flaws before attackers can find them. The move underscores both the promise and the new risk vectors introduced by more capable and widely available AI models. Read more AI-generated news on: undefined/news