Bitcoin Wallet Rescue Plan Sparks Concern Over Conditional Exposure

The Bitcoin Improvement Proposals repository has merged a proposal for a wallet backup system called BIP138. This development aims to rescue multisig wallets that have been locked due to lost seed phrases or descriptors.

According to the proposal, a multisignature wallet's descriptor records the public keys and spending rules necessary to reconstruct the account and find its coins. However, losing the descriptor can still leave a multisig or miniscript script impossible to recover from the seed alone.

BIP138 proposes creating an encrypted file that holds descriptors, wallet policies, or other non-seed metadata. Private key material must be removed before encryption to prevent unauthorized access. A holder of an eligible xpub from the backed-up wallet can decrypt a copy without the wallet's seed, revealing public keys and script structure needed for recovery.

The proposal sets limits on who can decrypt, excluding public keys that appear directly in a script or xpub roots that could be exposed by spending. This is done to prevent an on-chain public key from becoming a key to the off-chain backup. However, there are concerns about conditional exposure if an account's xpub has been disclosed before the multisig wallet was created.

A public Rust implementation with command-line build instructions exists for BIP138. The proposal's merge establishes a published draft, not a Bitcoin network change or a guarantee that today's wallets can create and restore this format.