Author #
Pyth (pythcoiner on GitHub, Wizardsardine) wrote BIP 138, its Rust reference implementation and its test vectors.
Where the idea came from #
The scheme builds on a backup design first proposed on Delving Bitcoin in April 2025 by Salvatore Ingala (salvatoshi on Delving Bitcoin, bigspider on GitHub). That post introduced the “secret vs private” framing and the idea of opening backups with the wallet’s own public keys. He also suggested the padding design.
Review and contributions #
As acknowledged in the specification:
- Sjors Provoost (Sjors) for extensive review, many design contributions to how contents are stored, and a proof-of-concept implementation on top of Bitcoin Core.
- murchandamus, jonatack, craigraw, jp1ac4 and torkelrogstad for their reviews and suggestions.
The Delving Bitcoin discussion also shaped the design. In particular, josh explored threshold-based alternatives, and kloaec raised the idea of dedicated backup keys and the question of long-term storage.
Sources
- BIP 138 specification (also readable at bips.dev/138)
- Pull request #1951 and its review
- Original Delving Bitcoin discussion
- Bitcoin development mailing list post
- Rust reference implementation
- Bitcoin Core proof of concept
About this site #
This site explains the reasoning behind BIP 138 in plain language. It is not the specification. If anything here disagrees with the BIP, the BIP is right.
Content reflects BIP 138 version 0.1.3 (24 September 2026). Last reviewed 13 October 2026.