A new BIP lands for encrypting the wallet data that is not the seed
Victoria Shinder1 min readThe Bitcoin Improvement Proposals repository has taken in BIP-138, "Compact Encryption Scheme for Non-seed Wallet Data". The merge came through pull request #1951, opened by pythcoiner and merged by murchandamus, adding 1,931 lines across eleven files including bip-0138.md and an updated README.mediawiki.
The subject is the half of a wallet that is not the seed. A modern Bitcoin wallet is not only private keys: it carries output descriptors, which say what scripts to watch and how to spend them, together with labels and other bookkeeping. That material is what makes a seed usable again after a loss, and it has historically had no standard way to be stored encrypted.
What it means
Seed backup is a solved problem with a well-worn vocabulary — mnemonics, passphrases, metal plates. Descriptor backup is not, and for multisig and miniscript setups the descriptor is not optional: a seed without it may leave funds unrecoverable in practice even though the keys are intact.
The specific thing a standard buys here is interoperability between a wallet that writes a backup and a different wallet that has to read it years later, under conditions where the user cannot ask the original vendor anything. That is the scenario descriptor backup exists for, and it is the one a proprietary format fails.
Read the status honestly: a BIP in the repository is a published specification, not a deployed feature and not a consensus change. Nothing in any wallet changes because a document was merged. What to watch is whether wallet implementations adopt the same scheme, because a backup format with two incompatible implementations is worse than none. We have not reviewed the cryptographic construction here; the document itself is the place for that.