Watch-Only Bitcoin Wallet: Secure Mobile Monitoring

Securely Monitor Bitcoin on the Go

Those who self-custody their Bitcoin long-term usually use a hardware wallet. To protect private keys from online attacks, this device usually remains safely stored at home. While this provides excellent Bitcoin security, it limits everyday flexibility: how can you quickly check on the go if a payment has been received? How do you spontaneously generate a new receiving address without having your physical hardware wallet with you?

The solution to this everyday dilemma is a so-called watch-only wallet. It allows you to monitor your Bitcoin holdings on your mobile device without your private keys ever leaving your cold storage medium. In this way, you combine the best of both worlds: the uncompromised security of cold storage with the convenience of a mobile app.

In this practical guide, you will learn how a watch-only wallet works, how to set it up step-by-step, and how to minimize potential privacy risks to seamlessly integrate Bitcoin self-custody into your daily life.

The Principle of Separation of Functions

A classic Bitcoin wallet essentially performs two main tasks: it manages public keys to generate receiving addresses and display balances, and it manages private keys to cryptographically sign transactions and send Bitcoin.

A watch-only wallet strictly and securely separates these two tasks:

The public part (XPUB): You only import the extended public key (usually referred to as xpub, ypub, or zpub) into an app on your smartphone.
The private part (Private Key): The private keys remain securely on your hardware wallet in cold storage.

With the imported xpub, the smartphone app can calculate all associated Bitcoin addresses, query balances, and generate new receiving addresses. However, because the app never has access to the private keys, it is physically impossible to send Bitcoin from this smartphone. Even if your smartphone is stolen, lost, or hacked, your Bitcoin holdings remain absolutely safe from unauthorized withdrawals.

flowchart LR
%% Separation of Functions Between Hardware and Watch-Only Wallet
    node_0_0["Hardware Wallet (Offline)"] --> node_0_1["Protects Private Keys"]
    node_0_1["Protects Private Keys"] --> node_0_2["Secure On-Device Signing"]
    node_0_0["Hardware Wallet (Offline)"] --> node_1_1["Exports XPUB (ZPUB)"]
    node_1_1["Exports XPUB (ZPUB)"] --> node_1_2["Smartphone App (Watch-Only)"]
    node_2_0["Smartphone App (Watch-Only)"] --> node_2_1["Calculates Addresses & Balances"]
    node_2_1["Calculates Addresses & Balances"] --> node_2_2["No Send Function (Absolutely Secure)"]

Setting Up the Watch-Only Wallet

Setting up is straightforward and requires no deep technical knowledge. You only need your hardware wallet, its associated desktop software, and your smartphone.

First, you need to find the extended public key. Depending on the hardware wallet you use, the exact path in the software (e.g., BitBoxApp, Ledger Live, Trezor Suite) may vary slightly. However, the principle remains the same: navigate to the account settings of your Bitcoin account, look for terms like "extended public key", "account information", or "show XPUB/ZPUB", and display this key as a QR code on your computer screen. Modern wallets mostly use Native SegWit (addresses starting with bc1q) or Taproot (starting with bc1p), whose corresponding public keys usually start with zpub or xpub.

Next, choose a suitable watch-only app on your smartphone. Download a trusted, open-source option. Proven apps include BlueWallet (very beginner-friendly for iOS & Android), Sentinel (specialized in watch-only for Android), or Blockstream Green (versatile and robust for both operating systems).

Open the chosen app on your smartphone, select "Add Wallet" or "Import", and choose the "Watch-Only" option. The app will prompt you to enter the key. Use your smartphone camera to scan the QR code displayed on your computer screen. Then, assign a clear name, such as "Cold Storage Watch". The app will immediately sync with the Bitcoin blockchain and display your exact balance and full transaction history within a few seconds.

Generating Addresses Securely on Mobile

Your watch-only wallet is now fully operational. You can now easily verify incoming payments on the go and see in real time when a transaction is sent to your addresses. If you want to receive Bitcoin, simply tap "Receive" in the app. The app automatically generates a fresh address from your exported xpub. You can show this QR code to your transaction partner so they can initiate the payment.

Before receiving larger amounts via an address generated on your smartphone for the first time, you should perform a security check. Compare the first address generated by the watch-only app with an address displayed directly on your hardware wallet or its official desktop software. If both addresses match, the app is working flawlessly and you have transferred the xpub correctly.

If you would also like to verify the basic integrity of your physical backup at this opportunity, our guide The Recovery Drill: Securely Verifying Your Hardware Wallet Backup will help you. A robust, physical backup is the foundation of any secure self-custody setup, ideally implemented using fireproof and waterproof solutions, as detailed in the article From Paper to Steel: Securely Creating and Verifying a Bitcoin Backup.

Minimizing Privacy Risks

Although a watch-only wallet reduces the theft risk of your Bitcoin to zero, there are important aspects of privacy and physical security that you should understand and proactively manage.

First, the security of your coins remains completely intact. Since no private keys are stored on the smartphone, unauthorized transfers are impossible—no additional protective measures are needed in this regard, as the private keys remain at home.

Second, the visibility of your financial data on the network poses a potential risk. The operator of the default Bitcoin node your wallet app connects to can theoretically see which addresses belong to you by linking your IP address with the queried XPUB. To sever this link, you should use a VPN when using the app or connect your watch-only app directly to your own Bitcoin node (for example, via the Tor network).

Third, you must consider the physical security of your mobile device. Anyone who gets hold of your unlocked smartphone can view your entire Bitcoin balance, which in the worst-case scenario could make you a target. Therefore, always protect your mobile wallet app with a separate, strong PIN or biometric lock like FaceID or fingerprint to effectively prevent unauthorized viewing in everyday situations.

Sovereign Bitcoin Self-Custody in Daily Life

Setting up a watch-only wallet is an important and logical step toward sovereign, flexible, and practical Bitcoin self-custody. It decouples daily information-gathering and interaction—such as checking your current balance or generating new receiving addresses for business partners and friends—from the critical, highly secure signing function.

This ensures you remain fully capable of taking action and informed about your finances at all times while on the go, while your private keys rest untouched in cold storage, protected from any digital or physical access. With this setup, you master the balance between maximum security and practical flexibility on the Bitcoin standard.