How to verify a wallet with an extended public key (xpub)

When you send/withdraw bitcoin on-chain to a new address, Bitaroo needs you to prove that the address belongs to a wallet you control.

Providing your extended public key is one way to do this. Bitaroo uses this key to confirm that the address you are sending to was generated by your wallet.

This method is quick and is a one-off per wallet, but it does share more information than message signing, so it is worth reading "Privacy Matters" below before you use it.

What is an extended public key?

An extended public key is a single key that your wallet can share so that software can see all of the addresses your wallet generates. It does not allow anyone to spend your bitcoin. Depending on your wallet and address type, it begins with xpub, ypub or zpub. Bitaroo accepts all three.

Before you start

• Use the same wallet that owns the address you are withdrawing to.
• Have your wallet open. You will copy one long string of letters and numbers.
• Never share your private key, seed phrase or recovery words. They are different from an extended public key and must be kept secret. Bitaroo will never ask for them.

The steps at a glance

1. In your wallet, find the extended public key (often under Settings, Information, or Export).
2. Copy the key (it begins with xpub, ypub or zpub).
3. In Bitaroo, choose "Extended Public Key", then paste the key into the box.
4. Select "Verify Key". If the address belongs to that key, it is confirmed and your withdrawal continues.

If the address belongs to that key, it is marked as verified and you can continue your withdrawal. A verified address is remembered, so you will not need to repeat this for future sends to the same address.

Below are step-by-step instructions for finding your extended public key in three common wallets: Electrum, Sparrow and BlueWallet. Follow the one that matches your wallet, the process is much the same in others. There is a note on hardware wallets below.

Electrum (desktop) Open Electrum and select the wallet that holds the address. Open the Wallet menu and choose "Information". Copy the "Master Public Key" shown there (for a native SegWit wallet it begins with zpub). Paste it into Bitaroo and select "Verify Key".

Sparrow (desktop) Open Sparrow and select the wallet that holds the address. Open the "Settings" tab (the cog icon) for the wallet. Copy the extended public key shown for the keystore (Sparrow may label it "xPub"). Paste it into Bitaroo and select "Verify Key".

BlueWallet (mobile) Open BlueWallet and tap the wallet that holds the address. Open the wallet menu and choose the option to show the wallet "XPUB" (sometimes under wallet settings or export). The exact location varies a little by version. Copy the key shown, or scan its QR code with Bitaroo. Paste or scan it into Bitaroo and select "Verify Key".

Hardware wallets

Most hardware wallets do not show the extended public key on the device itself. The usual route is to open the wallet in the app you pair the device with, and copy the key there.

• BitBox02. Open the BitBoxApp, select your Bitcoin account in the sidebar, then choose Account info in the top right. The extended public key is shown there, with a control to copy it.
• Passport and other devices that pair by QR code or microSD card. Connect the device to Sparrow or Electrum, then follow the Sparrow or Electrum steps above. The QR these devices show for pairing is usually animated and carries a full wallet descriptor, so it cannot be scanned into Bitaroo directly.
• Any other hardware wallet. Connect it to Sparrow or Electrum and follow the steps above.

Whichever route you use, make sure the key comes from the same account that owns the address you are sending to, and paste only the part that begins with xpub, ypub or zpub.

Finishing in Bitaroo Whichever wallet you used, the last step happens back in Bitaroo. Paste the extended public key into the box and select "Verify Key". If the address you are sending to belongs to that key, you will see an "Address Verified" confirmation and your withdrawal continues. A verified address is remembered, so you will not need to repeat this for future sends to the same address.

A note on xpub, ypub and zpub

Your wallet may show the key as xpub, ypub or zpub depending on the address type it uses. Copy whichever your wallet shows. Bitaroo accepts all three. If your wallet shows the key as a QR code, you can scan it in the Bitaroo app, and the key will be read for you even if the QR also contains extra information such as a derivation path. This works with a single, still QR code. Some hardware wallets display an animated QR that cycles through several frames, and those cannot be scanned, so pair the device with Sparrow or Electrum and copy the key from there instead. On the web platform, paste the key rather than scanning it.

Privacy Matters

Bitaroo built this verification model to protect your privacy, as well as the privacy of all our other users.

The Travel Rule, introduced on 1 July 2026, forces exchanges to routinely share customers’ personally identifiable information and, in many cases, engage with globally centralised third parties (“Travel Rule Providers”) whenever bitcoin moves to or from a custodial service. Those arrangements often expose the exchange’s hot wallet to chain surveillance corporations, giving them visibility into the activity of all users transacting through it.

Bitaroo remains compliant by removing the need for these “information-sharing” arrangements altogether.

By verifying that you control your own wallet, we can keep your personal information out of unnecessary hands.

Of the three verification methods, sharing an extended public key is the one with the greatest privacy trade-off. Because the key lets software derive every address your wallet creates, anyone with access to it, including Bitaroo, can see every address in that wallet and its balances and transaction history, past and future. It does not allow anyone to spend your bitcoin, but it does reveal that wallet’s complete activity.

If that matters to you, you have two good options:

• Use message signing instead. It proves you control the address without revealing any of your other addresses or balances.
• Use a dedicated wallet just for Bitaroo. Create a separate wallet, with its own seed, that you use only to receive Bitaroo withdrawals, and share that wallet's extended public key. Each withdrawal can arrive at a fresh address in that wallet, and whenever you like you can on-send the funds to your main wallet. Bitaroo only ever sees the dedicated wallet, so your main wallet stays private.

If your key is not accepted

• Wrong wallet or account. The key must be from the same wallet and account that owns the address you are sending to.
• The key was cut off. Copy the whole key, with no spaces or line breaks. It is long.
• Extra text was included. Some wallets export the key inside a longer "descriptor". Paste only the part that begins with xpub, ypub or zpub, or scan the QR code and let Bitaroo extract the key.
• You copied the wrong thing. Make sure it is an extended public key (xpub/ypub/zpub), not a private key or seed phrase.

Still need help?

If you have tried the steps above and verification still fails, please contact our support team and we will help.