A new proposal for Bitcoin is to recover a locked wallet of the type multisig in exchange for an undisclosed fee.

What's this about?

The wallet backup proposal, named BIP138, for the Bitcoin wallet Bitcoin was included in the Bitcoin Improvement Proposals repository on 21 September but is still in draft status. Its purpose is to store data at the seed phrase portion of a complex wallet that may not be recoverable; specifically the multisignature wallet , or multisig , which requires more than one signer and descriptor who records public keys with spending rules so that wallet can reconstruct accounts and retrieve coins.

Why wouldn't basic information be enough?

One signer's seed phrase can regenerate that signature, but it doesn't mean every structure or miniscript is going to be rebuilt from seed alone. If the descriptor disappears, reconstructing accounts may not be possible for complex scripts. In this case, an wallet designed to survive when one of its signers' seeds goes missing could also cause the other signer to lose some part of the script needed to recover coins.

Restrictions on privacy.

A BIP138 backup file is an encrypted file that stores descriptors, wallet policies or non-seed metadata and must remove private key material prior to encryption. But the caveat here is that if a third party already has eligible extended public key or xpub from wallet , and receives a copy of the back up, they may decrypt without using any seeds of wallet . The data would be visible public keys and script structure needed for recovery but xpub alone does not provide private keys used sign or spend coins.

The BIP138 also limits who can access the decrypt by public keys that appear directly in scripts and xpub roots, which may be exposed when spending. If a cosigner's key is removed, the co-signer will use it to open the file.

The privacy alert was directed at xpub, which had been leaked before multisig wallet was created. If the service provider or someone else knew that eligible xpub existed and got an encrypted backup copy, they could open the file and see the metadata on the recovery side, but didn't see private keys spending money.

Overall, BIP138 attempted to close the loophole in multisig recovery but encrypted backups could still open metadata for those with eligible xpub

Related cases.

The security aspect of the seed is also important, because there's a reported vulnerability in the Coldcard seed generation that indicates attackers can recreate private keys by pressing a button, which makes it clear that backing up metadata alone isn't enough.

What should Thai and Myanmar users understand?

For Thai users who store Bitcoin with a private wallet or use an exchange-connected system such as Bitkub that uses THB , the backup descriptor and security policy are technical issues to be done before using multisig or miniscript. The the SEC (Thailand) office oversees digital asset business in Thailand, so users should check the terms of service provider and security reactivity according to stated standards actually used, not translated from Draft only edition

In Maine, people accessing exchange services or THB boxes through border channels may rely more on self-custody but BIP138 is still drafted so it's not a mandatory standard that every wallet must be certified immediately. Those planning to use the multisig should test backup and recovery on an authenticated wallet , and store seed data, descriptors, and backup files in separate secure locations so there are no vulnerabilities where seeds cannot be recovered.