BIP138’s answer is an encrypted file holding descriptors, wallet policies or other non-seed metadata. Private key material must be removed before encryption. A holder of an eligible xpub from the backed-up wallet can decrypt a copy without the wallet’s seed. That reveals public keys and script structure needed for recovery, while the xpub alone does not give the holder the private keys required to sign.
The draft sets limits on who can decrypt. Public keys that appear directly in a script, and xpub roots that could be exposed by spending, are excluded as recovery keys. If a cosigner’s key is excluded, that person cannot use it to open the file. Those limits keep an on-chain public key from becoming a key to the off-chain backup.
The privacy warning concerns an xpub disclosed before the multisig wallet was made. If a wallet-service server already knows an account xpub and that same xpub is reused as an eligible multisig key, the server could decrypt the backup if it gets a copy. It could learn the wallet metadata inside, though this would not itself give it spending authority. The BIP describes a conditional exposure, not a reported breach.
A public Rust implementation with command-line build instructions exists. The BIP says Liana, a Bitcoin wallet, uses an earlier backup format that is incompatible with the current BIP138 file. The proposal’s merge therefore establishes a published draft, not a Bitcoin network change or a guarantee that today’s wallets can create and restore this format.
