BitGo has a feature where you can have multiple addresses under a wallet. The wallet also has its own address. Now suppose I have two addresses under my wallet. This means for any user to send me BTC, I can give one out of any three addresses which is 2 addresses + 1 wallet address.
How is that even possible to link two bitcoin addresses?
According to their website Wallet They use BIP32 Hierarchical Deterministic wallet. This is a way to link child addresses to the "wallet address".
Basically, your "Wallet Address" is the Master Node in the hierarchy. You can derive any descendant addresses in the hierarchy by knowing it's node location (eg. m/0/1 is the 2nd grandchild). Using the Child Key Derivation Function you can derive any key pair deterministically from the Master Seed (usually a mnemonic phrase you set up the first time in your wallet).
Here is a diagram from the BIP:
TL;DR: Keep all of your private keys (and especially your seed phrase!) safe and you should be ok.
Unless your wallet does hardened child keys, you may be exposing your parent private key if your parent extended key and any child private key is leaked:
Knowledge of a parent extended public key plus any non-hardened private key descending from it is equivalent to knowing the parent extended private key (and thus every private and public key descending from it)
The wallet is simply a logical separation (or group, in this case). It simply means that multiple keys are kept in the same wallet.
As far as the blockchain is concerned, there is no wallet, just a set of output scripts, controlled by private keys.
The described behavior is not unique to BitGo: wallets in Bitcoin generally track a collection of addresses. In fact, it is considered bad practice to reuse the same address (see address-reuse) for multiple payments due to privacy concerns.
As JBaczuk mentioned, BitGo uses Hierarchical Deterministic wallets. Hereby, BitGo exclusively employs 2-of-3 multisig addresses, which means that the body of addresses in a wallet are linked by all being derived from the same three master private keys and their corresponding keychains. As the name implies addresses are deterministically derived, which means that any number of addresses can be generated and any of these addresses can be recalculated with the knowledge of the three keys and the derivation path of an address.
On the V1 platform of BitGo, the first address of a wallet also seconds as the wallet identifier. On the V2 platform, wallet identifiers have a separate format from Bitcoin addresses. The wallet address is perfectly capable of receiving funds, although it may be preferable to start with the first derived address. A new address should be used for every subsequent payment or invoice after that.
Note that BitGo is only adding new features to the V2 platform, so if you are just starting to use BitGo and created a V1 Bitcoin wallet, you may want to use a V2 Bitcoin wallet instead to get access to the latest and future features.
Disclosure: I'm a software engineer at BitGo.
