HD Wallet Derivation Paths
Modern cryptocurrency wallets are hierarchical deterministic (HD): a single BIP-39 seed phrase (12–24 words = initial entropy + checksum) is stretched by PBKDF2-HMAC-SHA512 (2048 rounds) into a 512-bit seed, from which BIP-32 derives a tree of key pairs. Every key the wallet will ever use is a deterministic function of the seed phrase plus a derivation path — a slash-separated index walk down that tree, e.g. m/44'/60'/0'/0/0. This is why one seed phrase restores every account in MetaMask, Phantom, Ledger, Trezor, or Keystone.
Path anatomy (BIP-44)
m / purpose' / coin_type' / account' / change / address_index
| Level | Meaning | Common values |
|---|---|---|
purpose' | Which standard | 44' (BIP-44), 49' (SegWit-compat), 84' (native SegWit) |
coin_type' | Which chain, per SLIP-44 | 0' Bitcoin, 60' Ethereum, 501' Solana, 397' NEAR |
account' | Separate accounts under one seed | 0', 1', … |
change | External (receiving) vs internal (change) chain | 0 / 1 (Bitcoin habit; often just 0 elsewhere) |
address_index | The n-th address | 0, 1, … |
The prime (') marks hardened derivation: child keys derived from the parent’s private key, so compromise of one child private key (or of the extended public key) cannot expose siblings. Non-hardened derivation uses the parent public key and allows watch-only xpub export — at the cost of the cross-linkability. 1
Per-chain conventions (the interop trap)
The standards leave degrees of freedom, and wallets historically made different choices — so restoring a seed phrase in different software can yield a different address set and an apparently empty wallet. The assets aren’t gone; the software is looking at different leaves of the same tree.
- Ethereum (MetaMask et al.):
m/44'/60'/0'/0/n— the address index varies per account. - Ledger Live (ETH):
m/44'/60'/n'/0/0— the account level varies instead. Same seed, different addresses than MetaMask’s convention. - Solana (Phantom):
m/44'/501'/n'/0'— note Solana hardens the level above the leaf too, making individual Solana accounts resistant to cross-account key disclosure in a way default Bitcoin/Ethereum paths are not. Phantom pairs each Solana account with the EVM account atm/44'/60'/0'/0/nfor its multichain view. 2 - Hardware wallets (Keystone, Ledger, Trezor) let you change the derivation path explicitly to match another platform’s convention — the escape hatch when migrating a seed between ecosystems. Doing this without verifying the target address first risks “losing” funds that are still on-chain under a different path. 3
Operational notes
- The seed phrase encrypts to nothing by itself — wallet apps store derived keys in a file encrypted with a passphrase (not the seed), which is why passphrase compromise ≠ seed compromise.
- Recovery tools (walletsrecovery.org, Electrum’s path wizard) exist precisely because path conventions fragment across wallets.
- An address you expect is usually at
<base path>/0/0— a wallet showing you a shortened path likem/44'/60'/0'/0is implicitly walking to address index 0 on the external chain.
Sources
- BIP 32 — Hierarchical Deterministic Wallets
- BIP 44 — Multi-Account Hierarchy for Deterministic Wallets
- SLIP-0044 — Registered coin types for BIP-0044
- Derivation Paths | Locating Keys and Addresses in HD Wallets — learn me a bitcoin
- Supported derivation paths in Phantom
- Change the derivation path of addresses — Keystone Support
Related
- web3-identity — wallets as identity roots
- farcaster-protocol — FIDs custody-tied to Ethereum addresses derived this way
- erc721-nft-deployment — deploying from a specific derived account
- openssl-rsa-passphrase — the passphrase-vs-key distinction in a non-HD context