For web sites promoting items for bitcoin it’s a widespread follow to make use of xPub to derive a brand new deal with for every buyer. This has two advantages 1) utilizing a contemporary deal with protects the retailers privateness as monitoring the funds is tougher and a couple of) dealing with orders turns into a lot simpler as every particular person order has the bitcoin deal with as a singular identifier.

It’s true that even when the xPub will get leaked, the hacker wont have the ability to use any of the funds. However he’ll have the ability to see previous and future generated addresses and may monitor any and all site visitors within the pockets.

If the web site will get hacked there are methods for the hacker to steal bitcoin supposed for the service provider. For instance the hacker may change the web site’s xPub to his personal, so all the future transactions find yourself within the hackers pockets as an alternative of the retailers. What the guide is mentioning is that in a case of a hack, utilizing the xPub it’s inconceivable to steal any bitcoins that have been despatched earlier than the hack.