1

I have a multisig set up.

My seeds and hardware wallets are secure.

However, what would happen if someone got a hold of my Xpub file only?

Am I correct they could view my holdings and transactions, but without the minimum number of seeds/wallets, they could not send?

If I’m not sure Xpub file has been compromised, is it still a good idea to update my multisig set up?

Thank you

1 Answer 1

2

A multisig setup needs all cosigners' extended public keys because any of them, at any time, without the real time manifestation of the others, can derive the child public keys and generate all the addresses of this multisig.

However, what would happen if someone got a hold of my Xpub file only?

The multisig has N extended keys, where N is obtained from the format M-of-N multisig. If someone gets all of the extended public keys, they can generate all the addresses (watch-only wallet).

Am I correct they could view my holdings and transactions

You are.

but without the minimum number of seeds/wallets, they could not send?

Sending imply having the private key able to sign, which signature matches one of the public keys that construct the address. From the xpub file we cannot extract the private key, so no signing is possible.

If I’m not sure Xpub file has been compromised, is it still a good idea to update my multisig set up?

Sure is a strong word. If you think someone is sniffing your wallet operations you could do that but as said, they could not sign any transaction.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.