HD Wallets and Derivation Paths Explained (BIP44)

When you set up a cryptocurrency wallet and receive a 12-word seed phrase, that single backup gives you access to every account the wallet will ever create --- on Bitcoin, Ethereum, Solana, and any other supported chain. The mechanism that makes this possible is called an HD wallet, and the system of addresses it uses is governed by derivation paths.

This guide explains how HD wallets turn one seed into an unlimited number of keys, what a derivation path like m/44'/60'/0'/0/0 actually means, and why getting the path right matters when you move between wallets or blockchains.

What Is an HD Wallet?¶

HD stands for Hierarchical Deterministic. The term comes from BIP32, a specification published in 2012 that defines how to derive a tree of cryptographic key pairs from a single root.

Hierarchical means the keys are organized in a tree structure --- a parent key can produce child keys, and those children can produce grandchildren. The tree can branch as deeply as needed.

Deterministic means the process is repeatable. Given the same root (the master seed), the same tree of keys is produced every time, in every wallet that follows the standard.

Before HD wallets, every new address required generating and backing up a separate random private key. If you generated 100 addresses, you needed 100 backups. Miss one, and those funds were gone. HD wallets eliminated this problem. You back up the seed once, and every key the wallet derives in the future is already covered by that backup.

The root of the tree comes from a BIP39 seed phrase. The mnemonic is converted into a 512-bit binary seed via PBKDF2 (as described in BIP39 Explained). That 512-bit seed is split into a master private key (256 bits) and a master chain code (256 bits). Together, these form the root from which the entire tree grows.

Anatomy of m/44'/60'/0'/0/0¶

A derivation path is the address within the tree that identifies a specific key. It looks like a file path on a computer, and each segment tells you which branch to follow.

Let us decode m/44'/60'/0'/0/0, the standard path for the first Ethereum address:

m / 44' / 60' / 0' / 0 / 0
│   │      │     │    │   │
│   │      │     │    │   └── Address index (0 = first address)
│   │      │     │    └────── Change (0 = external/receiving, 1 = internal/change)
│   │      │     └─────────── Account (0 = first account)
│   │      └───────────────── Coin type (60 = Ethereum)
│   └──────────────────────── Purpose (44 = BIP44 standard)
└──────────────────────────── Master key (root of the tree)

Breaking down each level:¶

m --- The master key. Every derivation path starts here. This is the root derived directly from your seed.

44' --- The purpose. The number 44 indicates this path follows the BIP44 standard for multi-account, multi-coin wallets. The apostrophe (or ') marks this as a "hardened" derivation, meaning the child key cannot be computed from the parent public key alone --- it requires the private key. This is a security measure.

60' --- The coin type. Each cryptocurrency is assigned a number by SLIP-44 (more on this below). Ethereum is 60. Bitcoin is 0. Solana is 501. This level is what allows one seed to serve multiple blockchains without key collisions.

0' --- The account index. Think of this as separate wallets within your wallet. Account 0 is the default. You could use account 1 for a different purpose --- savings versus spending, for instance. Most users never go beyond account 0.

0 --- The change level. In Bitcoin's UTXO model, 0 means external (receiving) addresses and 1 means internal (change) addresses. Ethereum does not use change addresses in the same way, but the level is preserved for compatibility.

0 --- The address index. This is the final number that increments to produce new addresses. Index 0 is your first address, index 1 is your second, and so on. Your wallet increments this value each time you request a new receiving address.

BIP44 and SLIP-44 Coin Types¶

BIP44 standardized the derivation path structure shown above. It was published in 2014 and built on BIP32's key derivation with a fixed five-level hierarchy: purpose / coin type / account / change / address index.

SLIP-44 (Satoshi Labs Improvement Proposal 44) maintains the registry of coin type numbers. Each blockchain is assigned a unique integer so that the same seed produces completely different keys for different chains. Here are some common assignments:

Notice that Avalanche C-Chain uses coin type 60 (Ethereum's type) because its C-Chain is EVM-compatible and shares the same address format. The same applies to Polygon, Arbitrum, Optimism, and Base --- they all use m/44'/60'/0'/0/0, which means the same Ethereum address is valid on all these networks.

This is why when you add Polygon or Arbitrum to MetaMask, your address is the same as your Ethereum address. They all derive from the same path. The distinction happens at the network (chain ID) level, not the key derivation level.

Different Chains, Different Paths¶

While EVM chains share Ethereum's path, non-EVM chains use their own conventions, and the differences matter.

Bitcoin Paths¶

Bitcoin has evolved through several address formats, each with its own derivation standard:

Most modern Bitcoin wallets default to BIP84 (native SegWit) because it offers lower transaction fees. If you restore a seed in a wallet and your funds do not appear, the wallet may be scanning the wrong derivation path. Switching from BIP84 to BIP44 (or vice versa) in the wallet settings is usually the fix.

Solana Paths¶

Solana uses ed25519 instead of secp256k1, so its derivation is structurally different. The standard path is m/44'/501'/0'/0' --- note that all four levels are hardened (marked with '). Some Solana wallets use m/44'/501'/0' or m/44'/501', and the specific path varies by wallet application. Phantom and Solflare use different conventions, which can cause confusion when migrating. For a detailed walkthrough, see Solana Wallet Generation Guide.

XRP and Tron¶

XRP uses coin type 144 with path m/44'/144'/0'/0/0. Tron uses coin type 195 with m/44'/195'/0'/0/0. Both use secp256k1 like Bitcoin and Ethereum, but their address encoding differs.

BIP84 vs BIP44: Why Bitcoin Has Multiple Standards¶

If you have used Bitcoin, you may have noticed that some addresses start with 1, some with 3, and modern ones start with bc1q. This is not cosmetic --- each format corresponds to a different derivation standard and script type.

BIP44 (m/44'/0'/...) generates legacy P2PKH addresses (the 1... format). This was the original BIP32-derived Bitcoin path. It still works, but these addresses use more block space per transaction.

BIP49 (m/49'/0'/...) generates nested SegWit P2SH addresses (the 3... format). These were a transitional format that provided SegWit's fee savings while maintaining backward compatibility with older wallets.

BIP84 (m/84'/0'/...) generates native SegWit addresses using bech32 encoding (the bc1q... format). This is the most efficient format for standard transactions and is the default in most modern wallets.

The key insight is that all three formats can be derived from the same seed phrase. Your 12 words do not change. What changes is the purpose level in the derivation path: 44, 49, or 84. A wallet that supports all three will scan each path to find your funds.

When generating or restoring a Bitcoin wallet, always check which derivation standard the wallet uses by default. If you see a different address format than expected, the wallet is likely using a different BIP standard. To explore Bitcoin address formats in detail, see Crypto Address Formats Explained.

Step-by-Step Key Derivation¶

Here is how the full derivation works from seed phrase to a usable Ethereum address:

Step 1: Mnemonic to Seed¶

Your 12-word mnemonic is processed through PBKDF2-HMAC-SHA512 with 2,048 iterations and the salt "mnemonic" (plus an optional passphrase). The output is a 512-bit binary seed.

Step 2: Seed to Master Key¶

The 512-bit seed is processed through HMAC-SHA512 with the key "Bitcoin seed" (this key string is used regardless of the target blockchain). The left 256 bits become the master private key. The right 256 bits become the master chain code.

Step 3: Master Key to Child Keys¶

Starting from the master key, each level of the derivation path performs a child key derivation (CKD) function. For hardened children (marked with '), the parent private key and chain code are fed into HMAC-SHA512 along with the child index. The result is a new (child) private key and chain code.

For normal (non-hardened) children, the parent public key is used instead of the private key. This is what enables watch-only wallets --- you can derive public keys and addresses without having the private key.

Step 4: Private Key to Public Key¶

At the final level of derivation, the child private key is converted to a public key through elliptic curve multiplication. For Ethereum, this uses the secp256k1 curve. The operation is: Public Key = Private Key * G, where G is the generator point of the curve.

Step 5: Public Key to Address¶

The public key is hashed to produce the blockchain address. For Ethereum, the public key is hashed with Keccak-256, and the last 20 bytes (40 hex characters) become the address, prefixed with 0x. For Bitcoin, the process involves SHA-256 followed by RIPEMD-160, then Base58Check or bech32 encoding depending on the address type.

You can see this entire process in action using SafeSeed's Ethereum Address Generator or Bitcoin Address Generator, which show each step from seed to address.

Why This Matters Practically¶

Understanding derivation paths is not just academic. Here are concrete situations where it matters:

• Restoring a wallet in different software. If you move from Ledger to Trezor, or from MetaMask to a different wallet, make sure the derivation path matches. Same seed plus different path equals different addresses and apparently missing funds.
• Accessing multiple chains. Your seed phrase already covers Polygon, Arbitrum, and other EVM chains --- they all use Ethereum's coin type 60. No separate backup needed.
• Debugging missing funds. If you restore a Bitcoin seed and cannot see your balance, try toggling between BIP44, BIP49, and BIP84 paths in the wallet settings.
• Generating addresses for specific purposes. By incrementing the account index (the third level), you can create logically separate wallets --- one for daily spending, one for long-term storage --- all from the same seed phrase.

The derivation path system is what transforms a single seed phrase into a multi-chain, multi-account wallet. It is the infrastructure layer that makes modern cryptocurrency self-custody both powerful and portable. Once you understand it, you can move between wallets, chains, and address formats with confidence.