BIP138 draft offers multisig backups but risks xpub exposure

On Sept. 21, 2026, a draft of BIP138 was merged into the Bitcoin Improvement Proposals repository. The specification defines an encrypted backup file intended to restore multisignature accounts when a descriptor or a cosigner’s public key is lost. The draft does not change the Bitcoin network.

A multisignature wallet requires signatures from multiple parties to spend funds. A descriptor records the public keys and the rules that tell wallet software where coins are and how to construct transactions. A wallet seed can recreate a single signer’s private keys, but it may not restore the descriptor or a cosigner’s public key. Losing those items can make a multisig account unrecoverable from the seed alone.

BIP138 proposes an encrypted export format that holds descriptors, wallet policies and other non-seed metadata needed to rebuild an account. The proposal requires that private key material be removed before the file is encrypted.

The draft allows the encrypted backup to be unlocked by holders of certain eligible extended public keys (xpubs) from the original wallet. An xpub does not grant spending ability, but a holder who also obtains the backup file could decrypt and read public keys and script structure inside the encrypted data.

To limit exposure, the draft excludes any public keys that appear directly in a script and any xpub roots that would be revealed by spending from acting as recovery keys. If a cosigner’s key is excluded under those rules, that cosigner cannot use it to decrypt the backup.

The BIP describes a conditional privacy issue: if a wallet service or other server already knows an account xpub that later qualifies as a recovery key, and that server obtains a copy of the encrypted backup, it could decrypt and view the wallet metadata. The draft characterizes this as an exposure of metadata rather than a way to gain signing authority. Exposed items would include public keys and script structure required for recovery; private signing keys would not be revealed by the backup alone.

The specification is a draft and not a protocol upgrade. Implementations may use different formats; the Liana wallet uses an earlier backup format that is incompatible with BIP138. A public Rust implementation with command-line build instructions is available for developers who want to test the format.

BIP138 is aimed at wallets whose recovery depends on data beyond a single seed, mainly multisig and miniscript setups. The draft notes that wallet operators and users should consider how xpubs are shared and how services store account information.