Crypto Keys, Addresses & Derivation: Complete Wallet Guide

Understanding Crypto Keys, Addresses, and Derivation

When you use a self-custody crypto wallet, you retain total ownership of your digital assets. Unlike centralised exchanges, which store user funds in custodial accounts, a non-custodial setup places private keys directly in your hands. If you are comparing model types, our breakdown of custodial vs non-custodial wallets provides a foundational overview.

However, behind every wallet interface lies a complex cryptographic sequence. How does a single 12-word or 24-word recovery phrase generate hundreds of distinct accounts across Bitcoin, Ethereum, and Solana? The answer lies in key derivation.

Understanding how keys, public addresses, and derivation paths interact is essential for anyone taking full control of their Web3 assets. This guide explains the step-by-step math, structures, and common pitfalls of wallet architecture.

Key Takeaway: A seed phrase acts as the root master key for your entire wallet. Through standardized derivation paths (BIP-32/44), it mathematically generates infinite child private keys, public keys, and public addresses without ever exposing your private credentials.

---

The Cryptographic Hierarchy: From Entropy to Wallet Address

Creating a self-custody crypto wallet starts with randomness and transforms into actionable addresses through standardized Bitcoin Improvement Proposals (BIPs). Here is the technical pipeline breaks down into four primary stages.

```

[ Entropy (Randomness) ]

│

▼

[ Mnemonic Seed Phrase (BIP-39) ]

│

▼

[ Master Private Key & Chain Code (BIP-32) ]

│

▼

[ Derivation Path (BIP-44 / BIP-84) ]

│

▼

[ Child Private Key ] ──► [ Public Key ] ──► [ Public Address ]

```

1. Entropy to Mnemonic Seed Phrase (BIP-39)

Every wallet begins with entropy—a sequence of high-grade random numbers generated by your device hardware or software.

1. The wallet generates 128 to 256 bits of random entropy.
2. A checksum is calculated and appended to the entropy.
3. The combined bits are split into 11-bit segments.
4. Each 11-bit segment corresponds to a specific word in the standardized 2,048-word BIP-39 dictionary.

This sequence yields your 12-word or 24-word seed phrase. To learn how to protect this phrase once generated, read our guide on how to backup and restore your wallet.

2. Mnemonic to Master Seed and Master Key (BIP-32)

The mnemonic phrase itself isn't used directly in cryptographic transactions. Instead, it is converted into a 512-bit binary seed using the PBKDF2 function with HMAC-SHA512.

This binary seed generates the Master Private Key and a Master Chain Code. This system—known as Hierarchical Deterministic (HD) Wallet architecture (BIP-32)—allows a single master root to derive an unlimited tree of child keys.

3. Derivation Paths (BIP-44 and Beyond)

To ensure different wallet applications can reproduce the exact same child keys from the same seed phrase, developers use standard derivation path formats defined by BIP-44:

m / purpose' / coin_type' / account' / change / address_index

• m: Represents the master node.
• purpose': The standard specification being used (e.g., 44' for multi-account hierarchy, 84' for Native SegWit Bitcoin).
• coin_type': The specific cryptocurrency ecosystem (e.g., 0' for Bitcoin, 60' for Ethereum, 501' for Solana).
• account': Allows users to split their funds into separate logical accounts (e.g., 0', 1').
• change: 0 for external receiving addresses; 1 for internal change addresses.
• address_index: Incrementing index for individual addresses (0, 1, 2, 3...).

4. Derived Keys to Public Addresses

Once a specific child private key is computed via the derivation path:

1. Private Key to Public Key: The child private key is multiplied by a generator point on an elliptic curve (such as secp256k1 for Bitcoin/Ethereum or ed25519 for Solana). This is a one-way mathematical function; calculating the private key from a public key is computationally impossible.
2. Public Key to Address: The public key is hashed (using Keccak-256 for Ethereum or SHA-256 + RIPEMD-160 for Bitcoin) and formatted with a prefix or checksum to create the final public wallet address.

For a deeper look into the cryptographic relationship between keys, read our detailed article on how wallet addresses, public keys, and private keys relate.

---

Keys vs. Addresses: Key Differences and Roles

Understanding the distinct roles of keys and addresses is essential for practicing secure self-custody.

| Attribute | Seed Phrase / Master Root | Private Key | Public Key | Wallet Address |

| :--- | :--- | :--- | :--- | :--- |

| Primary Role | Full recovery of all derived accounts | Authorises transactions for one specific address | Mathematical proof of ownership | Public recipient destination for funds |

| Shareable? | Never | Never | Safe for advanced cryptographic operations | Yes (Safe to share publicly) |

| Scope | Global (Entire multi-chain wallet) | Single account / derivation node | Single account / derivation node | Single network account |

| Example | witch collapse mask... | 0x4c2...a91f | 0x04a3...71e | 0x71C...3922 |

---

Derivation Paths Across Multi-Chain Ecosystems

Modern Web3 users frequently interact with heterogeneous blockchain environments. Because distinct networks implement different curve cryptography and path standards, a single seed phrase behaves differently depending on the network.

If you manage multi-chain portfolios across EVM and non-EVM environments, see our dedicated guide to multi-chain Web3 wallet setup.

Ethereum and EVM Networks (BIP-44, Coin Type 60')

• Standard Path: m/44'/60'/0'/0/0
• EVM chains (Ethereum, Arbitrum, Polygon, BNB Chain, Optimism) use the same derivation path structure and elliptic curve (secp256k1). Consequently, your private key and public address will be identical across all EVM-compatible networks.

Bitcoin (BIP-44, BIP-49, BIP-84, BIP-86)

• Legacy (P2PKH): m/44'/0'/0'/0/0 (Addresses start with 1)
• Nested SegWit (P2SH): m/49'/0'/0'/0/0 (Addresses start with 3)
• Native SegWit (Bech32): m/84'/0'/0'/0/0 (Addresses start with bc1q)
• Taproot (Bech32m): m/86'/0'/0'/0/0 (Addresses start with bc1p)

Solana (Ed25519, Coin Type 501')

• Standard Path: m/44'/501'/0'/0' or m/44'/501'/0'
• Solana relies on the Curve25519 (Ed25519) signature scheme rather than secp256k1. Because of cryptographic differences, Solana addresses are Base58-encoded public keys derived directly from Ed25519 keypairs.

---

Common Derivation Errors and Security Pitfalls

Even experienced users run into wallet issues related to keys and derivation. Here are the most common scenarios and how to prevent them:

1. The "Missing Funds" Restoration Error: When restoring a wallet into software using custom settings, selecting an incorrect derivation path (e.g., BIP-44 instead of BIP-84 for Bitcoin) makes the wallet derive different child keys. Your funds are not lost on-chain, but the interface will show a zero balance until the correct derivation path is selected.
2. Confusing Public Keys with Addresses: Sharing an unhashed public key instead of your receiving address won't compromise your security directly, but sending tokens to an raw public key string can lead to stuck or permanent token loss.
3. Hardened vs. Non-Hardened Derivation: In BIP-32 paths, an apostrophe (') denotes hardened derivation. Hardened child keys prevent a compromised child private key (plus child chain code) from being used to mathematically calculate the master parent private key. Self-custody software should always enforce hardened keys at account level nodes.

To learn more about fundamentals and security practices, read our guide on what self-custody means or visit the Axxion help centre.

---

How Axxion Wallet Secures Keys and Derivation On-Device

Axxion Wallet is engineered to ensure you maintain total control over your private keys and derivation processes without technical complexity.

• Client-Side Generation: Your seed phrase, master seed, and private keys are calculated locally on your device. Private key data is never transmitted to external servers, cloud backups, or Axxion infrastructure.
• Encrypted Local Storage: Keys are secured using OS-level security hardware (such as iOS Secure Enclave or Android KeyStore) and protected by your hardware passcodes and biometrics.
• Multi-Chain Derivation Standardisation: Axxion Wallet automatically handles standard derivation paths across EVM networks, Bitcoin, and Solana, ensuring your balances render correctly across all supported networks upon setup or recovery.

Ready to manage your multi-chain assets securely? You can download Axxion Wallet directly or review our latest educational articles on our crypto blog.

---

Derivation Path & Key Management Checklist

Before executing high-value transactions or migrating wallets, run through this checklist:

• [ ] Backup Verification: Have you written down your 12 or 24-word recovery phrase accurately on offline physical media?
• [ ] Derivation Path Notes: If using custom or legacy wallets, have you documented the specific derivation path format used (e.g., m/44'/60'/0'/0/0)?
• [ ] Test Recovery: Have you tested restoring your seed phrase on a isolated secondary device or secondary software instance to verify address matching?
• [ ] Address Check: Are you confirming the target public address on-screen character by character prior to approving a transaction?
• [ ] Network Specifics: Are you sending assets to an address format supported by the destination blockchain?

Risk Note: Self-custody grants complete control of your cryptographic keys. Losing your recovery seed phrase or improperly handling private key data can result in permanent loss of digital assets. Neither Axxion Wallet nor any third party can recover lost seed phrases or reset your private keys.

---

Frequently asked questions

What is the difference between a private key and a seed phrase?

A seed phrase (mnemonic phrase) is the master root key that generates your entire wallet tree across all supported networks using standard protocols. A private key is a single derived child key responsible for authorizing transactions on one specific wallet address.

Can I lose my funds if I select the wrong derivation path when restoring my wallet?

No, your funds remain secure on the blockchain. However, selecting the wrong derivation path causes your wallet software to generate alternative child addresses, displaying a zero balance. Simply updating or correcting the derivation path within your wallet settings will locate and display your existing addresses and balances.

Why do Ethereum and Polygon use the exact same wallet address?

Ethereum, Polygon, Arbitrum, Optimism, and other EVM-compatible chains use the same elliptic curve cryptography (secp256k1) and identical default BIP-44 derivation paths (m/44'/60'/0'/0/x). Consequently, the resulting public key and derived address are identical across all EVM-based networks.