In book titled "Mastering bitcoin" 3th edition, on page 114, there is a sentence as below.

Gabriel’s website does not contain any private keys and therefore any hack of it can only steal the funds Gabriel would have received in the future, not any funds he received in the past.

I think hacker can not steal the funds received in the past and the future.


2 Answers 2


For websites selling goods for bitcoin it is a common practice to use xPub to derive a new address for each customer. This has two benefits 1) using a fresh address protects the merchants privacy as tracking the funds is harder and 2) handling orders becomes much easier as each individual order has the bitcoin address as a unique identifier.

It is true that even if the xPub gets leaked, the hacker wont be able to use any of the funds. But he will be able to see past and future generated addresses and can monitor any and all traffic in the wallet.

If the website gets hacked there are ways for the hacker to steal bitcoin intended for the merchant. For example the hacker might change the website's xPub to his own, so all of the future transactions end up in the hackers wallet instead of the merchants. What the book is pointing out is that in a case of a hack, using the xPub it is impossible to steal any bitcoins that were sent before the hack.

  • I also think your last paragraph is a possible interpretation of the quote. Just a note though, an exposed xpub plus any single private key can be used to obtain all private keys of that xpub Commented Feb 28 at 2:17

From a technical perspective, that statement is wrong. Obtaining the xpub alone is merely exposing all public keys, both past and future. However, as stated here, if an attacker could also obtain any single private key derived from that non-hardened path, they can obtain all other private keys associated with that xpub!

My guess however is that the quote actually means the possibility of a hacker swapping Gabriel's xpub with their own without anyone noticing for a while, thus getting paid in Gabriel's stead (as Juha also noted in their answer)

  • Thanks all! From a technical perspective, i also think this statement is wrong.
    – fa william
    Commented Feb 28 at 6:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.