Sparrow Wallet, a privacy-focused Bitcoin wallet, released version 2.5.4 on Thursday following an AI-assisted code review that yielded most of the update's security fixes, according to developer Craig Raw.
Raw said the review was prompted by the release of unrestricted Chinese AI models and the ability to search large codebases for potential exploits. He did not specify which AI models were used for the review.
Background and Motivation
The code review follows a July attack on Coldcard that exploited a vulnerability in its seed-generation code. The flaw allowed attackers to reconstruct private keys without accessing physical devices. Coldcard manufacturer Coinkite suggested AI may have helped the attacker identify the vulnerability.
"It was really the sudden arrival of the capability to search large codebases for potential exploits," Raw told Decrypt regarding the decision to conduct the review.
Security Improvements
The update includes dozens of security changes aimed at reducing reliance on outside services. Key improvements include:
- Transaction verification with Electrum servers to confirm returned transactions match those requested
- Cryptographic proof verification for transactions recorded in Bitcoin blocks
- Block chain confirmation checks before displaying transactions as confirmed
- Enhanced BitBox02 hardware-wallet security requiring firmware version 9.4.0 or later with anti-klepto protection
- Handling improvements for Ledger, Trezor, and Keycard devices
- Redaction of Bitcoin Core credentials and secrets from debug logs
- Restricted access to wallet and backup directories
- DNS leak closure when using Tor
No Evidence of Exploitation
Raw stated that no issues were found likely to put user funds at immediate risk. He personally reviewed each issue identified by the AI and confirmed no evidence that the vulnerabilities were exploited or that Sparrow users were affected.
"Every issue raised was carefully reviewed by myself, and multiple independent AI passes," Raw said.
Despite finding no active exploitation, Raw recommended that users install the update. He acknowledged that users running Sparrow on air-gapped computers may be reluctant to make changes and encouraged them to review the changelog to make an informed decision.
Broader Security Trend
Sparrow's AI-assisted review is part of a wider push across the Bitcoin ecosystem to use AI technology to identify vulnerabilities in wallets, payment protocols, and code libraries before attackers can exploit them.
