SPARROW 2.5.6 NOW CHECKS SIGNATURES ON ITS OWN PENDING PAYMENTS — THE FIX ELECTRUM SHIPPED AFTER ROGUE SERVERS TURNED A FEE BUMP INTO THEFT — NO ADVISORY, NO WORD ON OLDER VERSIONS

Sparrow Wallet 2.5.6 went up on GitHub at 13:22 UTC on October 29, 2026. Eleventh in its list of changes: “Verify wallet input signatures of unconfirmed transactions before adding them to the wallet history,” with a note that it was ported from Electrum. That is the fix for the attack Electrum disclosed on October 24 and we covered on October 25. A rogue server swallows the payment you just sent and shows your wallet a fake that spends the same coins to the attacker. The fake has bad signatures, and nothing checked them. If you then bump its fee, your wallet signs it for real.

Sparrow’s notes do not call this a security fix. There is no Sparrow advisory. The notes do not say whether earlier Sparrow versions would show such a fake, or whether any Sparrow user lost coins. The line sits among screen reader and keyboard changes. A second line runs the same kind of check on payjoin: the wallet now verifies the receiver’s input signatures before it looks at the proposed fee.

Electrum’s advisory set the limits, and they carry over. Clients that use a server they trust, such as their own, were never exposed. Even after the fix, only the wallet’s own inputs get checked, not incoming payments. Sparrow’s line also says wallet input signatures. A pending payment shown as coming in is still the server’s word until it confirms. You can hold every key and still be lied to about what your keys did.

The same release moves its bundled Tor to 0.4.9.5, which the notes say was needed to meet client protocols the Tor network now requires. They do not say what happens to older builds. Electrum’s workaround fits anyone on a public server: before signing anything, fee bumps included, check the output addresses and amounts on the device you trust. At the time of this writing, bitcoin was $80,569.