The open-source Bitcoin wallet patched DNS leaks over Tor, hardened hardware wallet integrations, and scrubbed sensitive data from debug logs after an AI review found no fund-threatening vulnerabilities.
Sparrow Wallet, the desktop-only Bitcoin wallet beloved by privacy maximalists, shipped version 2.5.4 on August 27 after running its entire codebase through an AI-assisted security review. The verdict: no issues that could put user funds at risk. The fixes that did land, though, tell a story about how seriously the project takes trust-minimized self-custody.
The update touches nearly every layer of the wallet’s security stack, from how it talks to hardware signers to how it routes traffic over Tor.
What actually changed #
The headline fix addresses residual DNS leaks that could occur when Sparrow routes connections through Tor. DNS leaks are the privacy equivalent of whispering a secret into a megaphone: even if your transaction data travels through an encrypted tunnel, a stray DNS query can reveal which servers you’re contacting to your internet provider. Sealing those leaks keeps Sparrow users closer to the anonymity Tor promises.
Hardware wallet support got several meaningful tweaks. The update adds retry logic for policy registrations on devices like Ledger, Trezor, BitBox02, and Keycard. In practice, that means fewer cryptic error messages when your hardware signer and Sparrow momentarily disagree about a multisig setup.
Sparrow also switched to constant-time ECIES MAC comparisons. That sounds like alphabet soup, so here’s the plain version: when the wallet verifies encrypted messages, it now does so in a way that doesn’t leak timing information. Attackers can sometimes figure out secret values by measuring how long a comparison takes. Constant-time checks eliminate that side channel entirely.
Another quiet but important change strips sensitive data, including Bitcoin Core RPC credentials, from debug logs. Developers and power users routinely share log files when troubleshooting. If those logs contain passwords or authentication tokens, sharing them becomes a security incident waiting to happen. Version 2.5.4 makes sure that doesn’t happen.
Directory permissions for wallet files are now restricted to the file owner. On shared or multi-user systems, that prevents other accounts from reading wallet data.
Payjoin transaction handling, PSBT processing, and multisig import validation all received incremental improvements as well. The update also tightens how Sparrow validates responses from Electrum servers, reducing the wallet’s dependence on those external nodes behaving honestly.
Sparrow’s niche in the wallet landscape #
Sparrow has carved out a distinctive position since its launch around 2020. It’s desktop-only in a market that gravitates toward mobile apps. It targets advanced users who want coin control, UTXO labeling, and direct connections to their own Bitcoin nodes rather than relying on third-party infrastructure.
Sparrow’s native support for features like Payjoin, which obscures transaction graphs by combining payments from sender and receiver, gives it an edge among users who treat on-chain privacy as non-negotiable.
Version 2.5.4 doesn’t introduce any splashy new capabilities. It’s a maintenance release in the best sense: tightening bolts, closing gaps, and making the existing feature set more resilient.
Disclosure: This article was edited by Editorial Team. For more information on how we create and review content, see our