Bitcoin's BIP138 wallet-backup proposal was merged into the Bitcoin Improvement Proposals repository on September 21 as a draft specification. The proposal addresses a specific recovery problem: seed phrases alone cannot reconstruct multisignature wallets when critical information is lost.
Multisignature wallets require multiple signers to authorize transactions. A wallet's descriptor records the public keys and spending rules that software needs to reconstruct the account and locate its coins. While a seed phrase can regenerate one signer's private keys, losing the descriptor or a cosigner's public key can make the multisig wallet impossible to recover from the seed alone.
BIP138 proposes an encrypted backup file containing descriptors, wallet policies, and other metadata beyond what a seed phrase stores. Private key material is removed before encryption. A person holding an eligible extended public key, or xpub, from the backed-up wallet can decrypt the file without knowing the seed phrase. This reveals the public keys and script structure needed for recovery, though the xpub alone does not provide the private keys required to spend funds.
The proposal includes restrictions on who can decrypt the backup. Public keys that appear directly in spending scripts and xpub roots that could be exposed through transactions are excluded as recovery keys. These limits prevent on-chain public keys from becoming keys to the off-chain backup.
A privacy consideration arises when an xpub is disclosed before the multisig wallet is created. If a wallet-service server already knows an account xpub and that same xpub is reused as an eligible multisig key, the server could potentially decrypt the backup if it obtains a copy. This would expose the wallet metadata inside, though not provide spending authority. The BIP describes this as a conditional privacy exposure rather than a reported breach.
A public Rust implementation exists with command-line build instructions. The Bitcoin wallet Liana uses an earlier backup format that is incompatible with BIP138. The proposal's merge establishes a published draft but does not constitute a Bitcoin network change or guarantee that existing wallets can create and restore this format.
