BlueWallet: watch your cold storage from a phone

Your hardware wallet is in a safe. Your coordinator software is on a desktop at home. And you are standing somewhere else, wondering whether that payment arrived.

A watch-only wallet solves exactly that. You give BlueWallet a public key, and the phone can see every address, every balance, and every transaction — while being completely unable to spend any of it. Lose the phone and you lose a phone.

It is a genuinely good idea with one cost that is worth understanding before you do it, and one temptation you should refuse.

A phone showing a bitcoin balance, held in one hand outdoors, with no hardware wallet or computer anywhere nearby.

Image to come

1What a watch-only wallet can and cannot do

An extended public key lets anyone derive every address in the account, but no private keys. That asymmetry is the whole feature.

• It can show your balance, your full transaction history, and every address you have used or will use.
• It can generate receive addresses and build unsigned transactions.
• It cannot sign anything, and therefore cannot move a single satoshi. There is no PIN to defeat and no setting to change — the capability is simply absent.

So a stolen phone is a stolen phone. Whoever takes it gets a view of your finances and no ability to touch them.

2The cost: a view is not nothing

That safety is real, and it makes people describe watch-only as risk-free. It is not — it is theft-free. The privacy cost is genuine and permanent.

An xpub reveals every address in the account, past and future, so anyone holding it can see your complete balance and history forever, and you cannot revoke it. How wallets find coins explains the mechanics properly; the practical consequence is what matters here.

• The phone itself is a copy of that xpub, sitting in the most frequently lost, stolen, and inspected device you own.
• By default your wallet asks somebody else's server for those balances, which tells that server every address you hold. See step 5.
• Border crossings and casual snooping reveal your total holdings to anyone who opens the app. Consider whether that is a picture you want available on your person.

None of that means do not do it. It means do it deliberately, and consider watching only the account you actually need to watch rather than importing everything you own.

3Importing the key

• Export the extended public key from your hardware wallet or coordinator. Most devices will show it as a QR code; Sparrow, Electrum, and the rest can export one too.
• In BlueWallet, add a wallet and choose the watch-only type.
• Scan the QR code, or paste the key if you must. Scanning avoids retyping a long string incorrectly.
• Check the balance and the last few transactions match what your desktop coordinator shows. If they do not, you have imported a different account — often the wrong script type or derivation path.
• Name it clearly, something that tells you which physical device holds the keys. Future you will have forgotten.

4The temptation to refuse

This is the section that justifies the page, so it is worth being blunt.

A watch-only wallet can generate receive addresses. It is right there, on your phone, when somebody asks where to send you bitcoin. And the entire reason the phone is useful is that your hardware wallet is somewhere else — which means you cannot verify that address on the device screen.

The situation that makes the phone convenient is exactly the situation in which you cannot check its work.

Verifying receive addresses on the hardware device's own screen is the standard defence against malware substituting an address, and it is covered in the Sparrow guide. On a phone away from your device, that check is unavailable.

• For small amounts, taking an address from the phone is a reasonable everyday risk, the same judgement you make with any hot wallet.
• For anything significant, wait. Go home, generate the address in your coordinator, and verify it on the hardware device before handing it over.
• Never use a phone-generated address for an exchange withdrawal of real size. That is precisely the transaction worth attacking, and precisely the one where you skipped the check.

5Choose what it talks to

By default, BlueWallet asks a public Electrum server for your balances, which hands that server your addresses and links them to your IP address.

BlueWallet can connect to your own node instead. If you run one, change this in settings — it closes the leak described in step 2 in a single step, and the privacy guide explains why it matters more than most other measures.

6Two things worth knowing about the app

• It can graduate to signing. BlueWallet works with COLDCARD, Passport, Jade, Keystone, and other PSBT-compatible devices, so the same app can later run the full sign-and-broadcast loop if you want it to. Watch-only is simply the safest place to start.
• Lightning is a separate thing in the same app. A Lightning balance is not your cold storage and does not live behind your hardware wallet. Keep the two mentally separate, and do not let a Lightning setup blur what your watch-only wallet is for.

The short version

Import an extended public key and your phone becomes a window onto cold storage that cannot spend anything. The price is that the phone now carries a permanent, unrevocable view of your finances, so point it at your own node if you can. And do not take receive addresses from it for amounts that matter, because the device that could verify them is exactly the device you left at home.