Watch-Only Wallets: Monitoring Without Risk

A watch only wallet holds no private keys, which is the entire point. It holds public keys or addresses derived from them: enough to display balances and history, and never enough to move a coin.

That asymmetry makes a watch only wallet the cheapest monitoring tool in self-custody. It can run on a laptop, a phone or a small server you would never trust with a seed phrase, and the worst outcome of a compromise is a privacy leak rather than a loss.

• A watch only wallet can read an account’s balance and history but cannot sign anything.
• The extended public key behind it reveals every past and future address in that account, so it is sensitive even without spending power.
• Most balance discrepancies come from the gap limit, not from missing funds.
• It complements a backup routine; it never replaces one.

What a watch only wallet can and cannot do

It reads the chain and attributes activity to addresses you control. Every function it offers is a view over public data, which is why it needs no seed and no hardware.

What it shows

Balances per address, incoming and outgoing transactions, confirmation counts and fee history. That is enough to reconcile a cold storage position, or give an accountant a running figure without handing over keys.

What it cannot do

It cannot sign a transaction, so it cannot spend, approve a contract or prove ownership to a service. If you try, the wallet will ask for a key it does not have. That failure is the feature, not a limitation to work around.

Where people get it wrong

The common mistake is treating the watch view as a backup. It is not. If the signing device and its seed are lost, the wallet still displays the balance and still cannot move it.

Three ways to build one

The choice is about what you hand over, not about which software looks better. Every method trades coverage against the amount of information you expose.

Extended public keys

An extended public key, sometimes written as xpub or zpub depending on the address format, generates every address in an account. Import it and the wallet derives the whole chain and stays in sync automatically, including addresses you have not used yet.

Single-address import

Importing one address at a time exposes the least information and demands the most maintenance. Every new receiving address has to be added by hand. It suits a fixed address used for occasional receipts, not a working account.

Watch mode on a signing device

Some hardware wallets can export a public key without exposing the seed, which lets companion software track balances while the device stays offline. This is the most common setup for long-term storage: the device holds the keys, the computer holds the view.

Monitoring tells you what you own. It never tells you that you can still reach it, and those two facts come apart at exactly the moment you need them together.

The gap limit and why balances disagree

Wallets do not scan the blockchain forever. They scan a fixed number of consecutive unused addresses, called the gap limit, and stop when that run is exhausted. Twenty is the usual default.

A worked example

Suppose your account has received funds on addresses numbered 0 through 24, but address 18, 19 and 20 were never used. A wallet with a gap limit of 20 scans from 0 and stops after 20 consecutive empties, which can leave addresses 23 and 24 outside the scan.

The watch only wallet reports 0.3315 while the signing device reports 0.4821. The difference is 0.1506 sitting on addresses the scanning window never reached. Nothing is missing on-chain; the view is truncated.

The fix is to raise the gap limit and rescan, which usually takes minutes. If your software cannot, import the missing addresses individually. Either way, reconcile against the signing device before concluding anything is wrong.

Why it matters more than it looks

A truncated view is a decision hazard. You might conclude a deposit never arrived, or report the wrong balance to an accountant, while the chain was correct and the tool was incomplete.

Fees are the other practical wrinkle. The view shows unspent outputs but cannot consolidate them. If an account has accumulated many small outputs, the eventual consolidation is a signing operation with a real fee, and the watch view will show the cost only after you build the transaction.

What a watch only wallet exposes

An extended public key is not secret in the way a seed is, but it is not public either. Anyone holding it can derive every address in the account, watch every incoming payment as it happens, and reconstruct the full history. They cannot spend, and they do not need to.

That matters because the leak is permanent. You can rotate to a new account, but you cannot unshare the old key. If any address in that account was ever tied to your identity through a venue’s records, the whole account is now tied to your identity.

Treat an extended public key like a bank statement that updates itself forever. Store it on the machine that needs it, not in a shared cloud folder, and do not paste it into a website that offers to check your balance.

Setting one up properly

1. Decide which account you are monitoring and confirm the signing device still works before you start.
2. Export the public key from the signing device itself, not from a copy of the seed typed into software.
3. Import it into the watch only wallet and let the initial scan finish completely.
4. Compare the total against the signing device screen; if they differ, raise the gap limit and rescan.
5. Send a small test amount to a freshly generated address and confirm it appears in both views.
6. Record which device and which account the view belongs to, so a future you can match them.
7. Keep the restore information for the view separate from the seed backup, and confirm the seed backup independently.