I’m setting up a Bitcoin wallet where the signing keys remain offline, while an online machine only has a watch-only output descriptor.
For example, the online wallet may contain an account xpub together with the master fingerprint, derivation path and address type, but it has no seed or private keys.
I understand that someone who obtains the descriptor cannot directly sign transactions, but they may be able to derive the wallet’s addresses and monitor its transaction history.
I’m trying to understand the exact security boundary here:
What information can an attacker learn from a watch-only descriptor alone?
Does leaking the descriptor create any direct risk of losing funds, or is it only a privacy risk as long as no private key is exposed?
If one non-hardened child private key were later compromised, could the account xpub contained in the descriptor then be used to recover the corresponding account private key?
Does the hardened account boundary protect the master key and other accounts in that situation?
From a practical security perspective, should a watch-only descriptor backup be encrypted and protected like private-key material, or is keeping a plaintext offline copy considered reasonable?
I’m specifically interested in standard Bitcoin HD wallets (for example BIP32/BIP84), rather than custodial wallets.
