How to verify a wallet with an extended public key (xpub)

When you send/withdraw bitcoin on-chain to a new address, Bitaroo needs you to prove that the address belongs to a wallet you control.

Providing your extended public key is one way to do this. Bitaroo uses this key to confirm that the address you are sending to was generated by your wallet.

This method is quick and is a one-off per wallet, but it does share more information than message signing, so it is worth reading "Privacy Matters" below before you use it.

What is an extended public key?

An extended public key is a single key that your wallet can share so that software can see all of the addresses your wallet generates. It does not allow anyone to spend your bitcoin. Depending on your wallet and address type, it begins with xpub, ypub or zpub. Bitaroo accepts all three.

Before you start

• Use the same wallet that owns the address you are withdrawing to.
• Have your wallet open. You will copy one long string of letters and numbers.
• Never share your private key, seed phrase or recovery words. They are different from an extended public key and must be kept secret. Bitaroo will never ask for them.

The steps at a glance

1. In your wallet, find the extended public key (often under Settings, Information, or Export).
2. Copy the key (it begins with xpub, ypub or zpub).
3. In Bitaroo, choose "Extended Public Key", then paste the key into the box.
4. Select "Verify Key". If the address belongs to that key, it is confirmed and your withdrawal continues.

If the address belongs to that key, it is marked as verified and you can continue your withdrawal. A verified address is remembered, so you will not need to repeat this for future sends to the same address.

Below are step-by-step instructions for finding your extended public key in three common wallets: Electrum, Sparrow and BlueWallet. Follow the one that matches your wallet, the process is much the same in others.

Electrum (desktop) Open Electrum and select the wallet that holds the address. Open the Wallet menu and choose "Information". Copy the "Master Public Key" shown there (for a native SegWit wallet it begins with zpub). Paste it into Bitaroo and select "Verify Key".

Sparrow (desktop) Open Sparrow and select the wallet that holds the address. Open the "Settings" tab (the cog icon) for the wallet. Copy the extended public key shown for the keystore (Sparrow may label it "xPub"). Paste it into Bitaroo and select "Verify Key".

BlueWallet (mobile) Open BlueWallet and tap the wallet that holds the address. Open the wallet menu and choose the option to show the wallet "XPUB" (sometimes under wallet settings or export). The exact location varies a little by version. Copy the key shown, or scan its QR code with Bitaroo. Paste or scan it into Bitaroo and select "Verify Key".

Finishing in Bitaroo Whichever wallet you used, the last step happens back in Bitaroo. Paste the extended public key into the box and select "Verify Key". If the address you are sending to belongs to that key, you will see an "Address Verified" confirmation and your withdrawal continues. A verified address is remembered, so you will not need to repeat this for future sends to the same address.

A note on xpub, ypub and zpub

Your wallet may show the key as xpub, ypub or zpub depending on the address type it uses. Copy whichever your wallet shows. Bitaroo accepts all three. If your wallet only offers the key as a QR code (common on hardware wallets), you can scan it with Bitaroo, which will read the key for you, even if the QR also contains extra information such as a derivation path.

Privacy Matters

Bitaroo built this verification model to protect your privacy, as well as the privacy of all our other users.

The Travel Rule, introduced on 1 July 2026, forces exchanges to routinely share customers’ personally identifiable information and, in many cases, engage with globally centralised third parties (“Travel Rule Providers”) whenever bitcoin moves to or from a custodial service. Those arrangements often expose the exchange’s hot wallet to chain surveillance corporations, giving them visibility into the activity of all users transacting through it.

Bitaroo remains compliant by removing the need for these “information-sharing” arrangements altogether.

By verifying that you control your own wallet, we can keep your personal information out of unnecessary hands.

Of the three verification methods, sharing an extended public key is the one with the greatest privacy trade-off. Because the key lets software derive every address your wallet creates, anyone with access to it, including Bitaroo, can see every address in that wallet and its balances and transaction history, past and future. It does not allow anyone to spend your bitcoin, but it does reveal that wallet’s complete activity.

If that matters to you, you have two good options:

• Use message signing instead. It proves you control the address without revealing any of your other addresses or balances.
• Use a dedicated wallet just for Bitaroo. Create a separate wallet, with its own seed, that you use only to receive Bitaroo withdrawals, and share that wallet's extended public key. Each withdrawal can arrive at a fresh address in that wallet, and whenever you like you can on-send the funds to your main wallet. Bitaroo only ever sees the dedicated wallet, so your main wallet stays private.

If your key is not accepted

• Wrong wallet or account. The key must be from the same wallet and account that owns the address you are sending to.
• The key was cut off. Copy the whole key, with no spaces or line breaks. It is long.
• Extra text was included. Some wallets export the key inside a longer "descriptor". Paste only the part that begins with xpub, ypub or zpub, or scan the QR code and let Bitaroo extract the key.
• You copied the wrong thing. Make sure it is an extended public key (xpub/ypub/zpub), not a private key or seed phrase.

Still need help?

If you have tried the steps above and verification still fails, please contact our support team and we will help.