CryptoSlate
Bitcoin's BIP138 wallet-backup proposal was merged into the Bitcoin Improvement Proposals repository on Sept. 21, but it remains a Draft specification. The proposal targets a recovery gap in multisignature and miniscript wallets: a seed phrase can restore one signer's private keys, while the descriptor containing public keys and spending rules may still be missing.
Why it matters
BIP138 describes an encrypted file containing descriptors, wallet policies and other non-seed metadata. Private key material is removed before encryption. An eligible extended public key, or xpub, from the backed-up wallet can decrypt a copy without the wallet seed, allowing recovery of the public keys and script structure needed to reconstruct the account.
The design also addresses wallets built to survive the loss of one seed. If that loss includes the signer's public key, the remaining signers may lack part of the script required to recover the coins. BIP138 is aimed at these specific setups, not ordinary Bitcoin wallets whose recovery data fits entirely within a seed phrase.
Market impact
The main tradeoff is privacy. If a wallet-service server already holds an account xpub and that xpub is reused as an eligible multisig key, the server could decrypt the backup if it obtained a copy. It could then read wallet metadata, although the xpub would not provide the private keys needed to sign transactions.
The draft excludes public keys that appear directly in a script and xpub roots that could be exposed through spending, limiting the chance that an on-chain key becomes an off-chain backup key. BIP138 is a published draft, not a Bitcoin network change or a guarantee that current wallets support the format. A public Rust implementation exists, while Liana uses an earlier incompatible backup format.
Frequently asked questions
-
What problem is Bitcoin BIP138 designed to solve?
BIP138 targets wallets whose recovery depends on descriptors, wallet policies or public keys beyond a seed phrase. Losing that metadata can prevent multisig or miniscript wallets from being reconstructed.
-
Can a seed phrase alone restore every multisig wallet?
No. A seed phrase can restore one signer's private keys, but the wallet descriptor and other public metadata may still be required to find coins and rebuild the spending script.
-
Who can decrypt a BIP138 backup?
A holder of an eligible extended public key from the backed-up wallet can decrypt a copy without the wallet seed. The xpub reveals recovery metadata but does not provide the private keys needed to sign.
-
What is the privacy risk in BIP138?
A wallet-service server that already holds an account xpub could read the encrypted backup if that xpub is reused as an eligible multisig key and the server obtained a copy.
-
Does BIP138 change the Bitcoin network or work with every wallet?
No. BIP138 remains a Draft proposal and does not change the Bitcoin network. Current wallet support is not guaranteed, and Liana's earlier backup format is incompatible with the draft format.
Crypto News
TheBlock
WuBlockchain
WatcherGuru
CoinTelegraph
CoinDesk