What is an HD wallet? HD stands for hierarchical deterministic, a type of wallet that can derive an entire tree of keys and addresses from a single seed. As long as the seed is the same, the derived keys are always the same, so backing up the seed once is enough to recover every address. Today almost all Bitcoin and Ethereum wallets are HD wallets, based on the BIP32 standard.
How Does an HD Wallet Generate Addresses?
The wallet first generates a random seed, usually shown to the user as a BIP39 mnemonic phrase for backup. The seed is turned into a master private key, from which child keys are derived layer by layer along a derivation path. A common BIP44 path looks like m/44’/0’/0’/0/0, representing purpose, coin type, account, receiving or change, and address index. A 1 at the fourth level marks the branch dedicated to generating change addresses. This way, a single seed can generate countless independent addresses for different coins and business lines.
What Are Extended Public Keys (xpub) Used For, and What Are the Risks?
A key feature of HD wallets is that an extended public key alone can derive all public keys and addresses beneath it, without touching any private key. Exchanges and payment providers can place the extended public key on business servers to generate a unique deposit address for each user, while keeping the private keys somewhere more secure. But an extended public key is not information to share freely: anyone who has it can see every address and balance on that branch. Worse, with normal (non-hardened) derivation, an extended public key combined with any single child private key can be used to work out the parent private key and take control of the whole branch. This is why BIP44 uses hardened derivation at the coin type and account levels.
What Should Businesses Watch Out For When Using HD Wallets?
The biggest risk is the seed itself: every address hangs on one seed, so if it is leaked or lost, all assets are affected. Businesses should either strictly manage how the mnemonic is generated, backed up and stored, or adopt an MPC wallet that never creates a complete private key, removing the single seed as a single point of failure altogether, which is the idea behind a seedless crypto wallet. Second, treat extended public keys as sensitive information, use them only in systems that need to generate addresses, and never store them alongside any child private key. Finally, when restoring or migrating a wallet, make sure the derivation paths match and that both the receiving and change branches are scanned; otherwise addresses may not match and balances may appear to be missing.
Conclusion
An HD wallet generates many keys and addresses from a single seed along derivation paths. It is easy to back up and can use an extended public key to generate deposit addresses in bulk without touching private keys. But the single seed and extended public keys are both sensitive points, and businesses need to protect them carefully or use MPC to remove the single point of risk. Safeheron’s MPC Wallet-as-a-Service provides businesses with MPC key management and a policy engine.
Want your business wallets free from single-seed risk? Contact Safeheron’s Sales Team to Book a 1:1 Demo
Looking for a secure way to manage digital assets?
Talk to our experts and find the right solution for your business.
Request a DemoLooking for a secure way to manage digital assets?
Talk to our experts and find the right solution for your business.