Watch-only is a window, not an opening

Updated September 2026

People export an xpub so a laptop can watch a hardware wallet. That is a reasonable window. It is not the observation that opens a hash-based address. Observation is still a spend — or Taproot receipt.

What an xpub is

A seed grows a tree of keys. The extended public key is the public side of one account in that tree. A watch-only wallet uses it to derive the same addresses the signer will use, then asks the chain whether those addresses have been funded or spent. That is how a desk computer can show a balance while the seed stays on a device. Read public versus private if those words are still sticky.

What it does not do

Holding an xpub does not let someone spend. It does not open a closed hash-based address. It does not turn a 1, 3, or bc1q receive into Taproot. The checker still looks at spend history and address type, not at whether you also run Electrum on a laptop.

What it leaks

Anyone with the xpub can list the addresses in that account and watch them. That is a privacy leak and a targeting leak: they can see which boxes exist, which have opened, and which still look closed. It is not the same as publishing a spend key, and it is not harmless. Treat an xpub like a bank statement, not like a business card. Do not paste it into a random “portfolio tracker” that also wants the seed “to sync.”

What to do

Use watch-only on a machine you accept can see your address list. Keep the seed on the signer. If a site asks for an xpub and a seed together, close it. If you want to know whether a particular string is open, paste the address, not the xpub, into the checker. No prices. No panic.