A newly merged Bitcoin Improvement Proposal, BIP138, introduces a standardized backup specification designed to recover complex multisignature and miniscript wallets without risking private keys. Merged into the official Bitcoin Improvement Proposals repository on Sept. 21, the specification remains in Draft status and addresses scenarios where traditional seed phrases fail to restore essential wallet descriptors and spending policies.
Solving Descriptor Loss in Complex Wallets
While a standard seed phrase can regenerate private keys for a single signer, complex wallet configurations require descriptors that record public keys and spending rules. If a user loses a descriptor or a missing signer's public key, wallet software cannot reconstruct the script or locate on-chain funds, leaving coins permanently inaccessible even if remaining seeds are intact.
To resolve this, BIP138 creates an encrypted backup file containing descriptors, wallet policies, and non-seed metadata, after stripping out all private key material. A holder of an eligible extended public key (xpub) associated with the wallet can decrypt the file without needing the seed phrase. This unveils the public keys and script structure required for account reconstruction without granting spending authority. To prevent on-chain exposure, public keys appearing directly in scripts and xpub roots exposed through spending are strictly excluded as recovery keys.
Technical Implementation and Privacy Risks
The proposal highlights a potential privacy tradeoff regarding key reuse. If an xpub was previously disclosed to a wallet-service server and subsequently reused as an eligible multisig key, that server could decrypt the backup file if it obtains a copy. While this conditional exposure would reveal wallet metadata and script structures, it would not provide private keys or signing authority.
Development of the specification is actively progressing alongside other technical proposals for Bitcoin. A public Rust implementation with command-line build instructions is already available. However, existing wallet software such as Liana currently utilizes an earlier backup format that is incompatible with the current BIP138 file layout.
Key Takeaways
- BIP138 was merged as a Draft specification on Sept. 21 to back up wallet descriptors and spending rules.
- Holders of an eligible xpub can decrypt metadata to reconstruct scripts without gaining private keys or spending power.
- Liana wallet currently relies on an earlier backup format incompatible with BIP138 files.
- The merge represents a published draft proposal rather than a consensus change to the Bitcoin network protocol.
Why It Matters
As institutional adoption and advanced self-custody solutions expand, descriptor loss poses a growing operational risk for multisig and miniscript setups. BIP138 establishes a potential standard for metadata recovery that prevents accidental loss of access to funds when a single public key or descriptor is misplaced. Moving forward, software developers will need to address xpub privacy safeguards before broadly implementing this backup standard across commercial wallets.
