An xpub is your wallet's extended public key: a single string that can generate every receiving address your wallet will ever hand out, without being able to spend from any of them. It exists so that software can watch your balance without holding the power to move it, which sounds like a clean division of labour and mostly is. The part people miss is that giving away an xpub gives away your entire financial history in one go, and there is no taking it back.
Where an xpub comes from
Modern wallets do not store a pile of unrelated keys. They derive every key from one secret using the hierarchical deterministic scheme described in BIP-32, which is why a dozen words can restore a wallet holding hundreds of addresses. The structure is a tree, and each branch has both a private side and a public side.
The extended public key is the public side of a branch. Hand it to a piece of software and that software can walk down the tree, working out address after address, for as far as it cares to go. It cannot walk back up to the private keys, because the derivation only runs one way. This is the property that makes watch-only wallets possible: your accountant, your portfolio tracker, or your own phone can follow the balance while the signing ability stays on a device in a drawer.
You may also run into ypub and zpub, which are the same idea labelled for different Bitcoin address formats. The privacy question below applies to all of them identically.
What somebody holding your xpub can see
Everything, on the receiving side, in both directions in time.
Given the extended public key, anyone can derive your addresses and look each one up on a public block explorer. That yields your current balance across every address the branch covers, every payment that has ever arrived at any of them, every payment that has left, the dates, the amounts, and the counterparties to the extent those are identifiable. Future addresses are included, because the derivation does not stop at the ones you have used. A person who copied your xpub in 2024 can still watch what you receive in 2027.
Bitcoin addresses are pseudonymous rather than anonymous, and an xpub collapses the pseudonymity of a whole account at once. Address reuse, exchange withdrawals in your name, and the clustering techniques that chain analysis firms apply commercially all become easier when an observer already knows which addresses belong together. You have handed them the answer to the hardest part.
What the holder cannot do is spend. That limit is absolute, and it is the reason the xpub feels safe to share. The loss is privacy, not funds.
Where xpubs leak in ordinary use
Rarely through an attack. Usually through convenience.
Portfolio trackers and tax software often ask for an extended public key, because it is the tidiest way to import a full transaction history. Reading the retention policy of a tax tool is not most people's idea of an evening, and the key sits in that company's database from then on, exposed to whatever happens to that database later. Some block explorers offer xpub lookup as a feature, which means pasting yours into a web form you do not control.
Support requests are the other route. Someone troubleshooting a balance that looks wrong will be asked for information, and an extended public key is a plausible-sounding thing for a helpful stranger to request. It is worth knowing in advance that no legitimate support process needs it, so the request itself is the warning.
The awkward property is that an xpub cannot be rotated. Changing a password is quick; withdrawing an exposed extended public key means creating a new account inside your wallet and moving every coin to fresh addresses, paying fees and leaving a visible trail that links the old account to the new one. Prevention is cheap here and the cure is not.
How to keep the convenience without the exposure
Use a separate account for anything you expose. Most wallets let you create more than one account under the same recovery secret, and giving a tracker the extended public key of an account you use for a slice of your holdings tells it about that slice and nothing else.
Prefer tools that watch by individual address rather than by xpub where the choice exists. It is more work to set up and it limits what you disclose to the addresses you chose to disclose.
Verify receiving addresses on your signing device rather than trusting what a watch-only view displays. A machine that knows your addresses is a machine that can be made to display a different one, which is why Ryder One shows the receive address on its own 1.6 inch AMOLED screen for you to confirm before you use it, and why the button that approves a transaction is wired directly to the secure element.
The key that does need protecting
An extended public key leaking costs you privacy. The secret it descends from is a different matter, because that one moves coins, and protecting it is the whole job of a hardware wallet.
Most people protect it by writing a seed phrase on a card, which leaves everything depending on one piece of paper surviving fire, water and house moves. Steel plates are the standard improvement and they solve the durability problem, though they keep the shape of the risk: one object that grants full access to whoever reads it and total loss to you if it disappears.
TapSafe Recovery splits the backup so no single item carries it. The Recovery Tag holds half, your paired phone holds the other half encrypted in your own iCloud or Google Drive rather than on the handset, and the two together restore the wallet. Neither piece discloses anything alone. Optional Recovery Contacts hold a quarter share each and see nothing about your balances. Your seed phrase remains available on the device as a last resort under the BIP-39 standard, so you are never locked to our hardware.
The short version
Treat your extended public key as sensitive rather than secret: sharing it cannot cost you coins, and it will cost you the ability to keep your holdings to yourself, for as long as that account exists.
Ryder One is 149 USD for the Starter Combo. Keys are generated inside an EAL6+ Infineon SLC38 secure element and never leave the chip, the device communicates over NFC only with no Bluetooth, USB data path or Wi-Fi, and the firmware has been audited by Halborn with the report published in full. Setup takes about sixty seconds.
Meta description: An xpub lets software watch your wallet without spending from it. What it reveals, where it leaks, and why an exposed xpub cannot be rotated.
Share: