Bitcoin Stack Exchange is a question and answer site for Bitcoin crypto-currency enthusiasts. It only takes a minute to sign up.
Sign up to join this community
I have a multisig set up.
My seeds and hardware wallets are secure.
However, what would happen if someone got a hold of my Xpub file only?
Am I correct they could view my holdings and transactions, but without the minimum number of seeds/wallets, they could not send?
If I’m not sure Xpub file has been compromised, is it still a good idea to update my multisig set up?
Thank you
A multisig setup needs all cosigners' extended public keys because any of them, at any time, without the real time manifestation of the others, can derive the child public keys and generate all the addresses of this multisig.
However, what would happen if someone got a hold of my Xpub file only?
The multisig has N extended keys, where N is obtained from the format M-of-N multisig. If someone gets all of the extended public keys, they can generate all the addresses (watch-only wallet).
Am I correct they could view my holdings and transactions
You are.
but without the minimum number of seeds/wallets, they could not send?
Sending imply having the private key able to sign, which signature matches one of the public keys that construct the address. From the xpub file we cannot extract the private key, so no signing is possible.
If I’m not sure Xpub file has been compromised, is it still a good idea to update my multisig set up?
Sure is a strong word. If you think someone is sniffing your wallet operations you could do that but as said, they could not sign any transaction.
