BIP-44 Derivation Paths: How Wallets Generate Addresses
When you set up a cryptocurrency wallet and it generates a seed phrase, that single seed needs to produce thousands of addresses across dozens of different blockchains — each with its own private key, public key, and address format. BIP-44 defines the organizational structure that makes this possible: a hierarchical tree of keys derived from a single root, with a standardized path notation that ensures wallets remain interoperable.
Understanding derivation paths is essential for anyone who needs to recover funds in a different wallet, manage multi-coin portfolios, or troubleshoot "missing" balances after restoring a seed phrase.
The Key Derivation Hierarchy
BIP-32: The Foundation
BIP-44 builds on BIP-32 (Hierarchical Deterministic Wallets), which defines a method for deriving an unlimited tree of key pairs from a single master key. BIP-32 introduced two fundamental concepts:
Child key derivation — From any extended key (a private or public key combined with a chain code), you can derive child keys at various indices. Each child can in turn derive its own children, creating a tree.
Hardened vs. normal derivation — Normal derivation allows deriving child public keys from a parent public key (useful for watch-only wallets). Hardened derivation requires the parent private key and provides stronger security isolation between branches. Hardened indices are conventionally written with an apostrophe (e.g., 44').
BIP-43: Purpose Field
BIP-43 established the convention of using the first level of the derivation tree to indicate the "purpose" — essentially the BIP standard being followed. BIP-44 uses purpose 44', BIP-49 uses 49' (for SegWit-compatible P2SH addresses), BIP-84 uses 84' (for native SegWit), and BIP-86 uses 86' (for Taproot).
BIP-44: The Full Path
BIP-44 defines a five-level derivation path:
m / purpose' / coin_type' / account' / change / address_index
Each level has a specific meaning:
| Level | Field | Hardened | Description |
|---|---|---|---|
| 1 | Purpose | Yes (44') | Identifies the derivation standard |
| 2 | Coin Type | Yes | Identifies the cryptocurrency |
| 3 | Account | Yes | Separates funds into logical accounts |
| 4 | Change | No (0 or 1) | External (0) or internal change (1) |
| 5 | Address Index | No (0, 1, 2...) | Sequential address number |
Purpose (44')
The purpose field is always 44' for BIP-44 standard derivation. Other common values:
49'— BIP-49 (P2SH-wrapped SegWit)84'— BIP-84 (Native SegWit / Bech32)86'— BIP-86 (Taproot / P2TR)
These define different address types and are explained in their respective BIPs.
Coin Type
The coin type identifies which cryptocurrency the derived keys belong to. Registered coin types include:
| Coin | Coin Type | Path Prefix |
|---|---|---|
| Bitcoin | 0' | m/44'/0' |
| Bitcoin Testnet | 1' | m/44'/1' |
| Litecoin | 2' | m/44'/2' |
| Dogecoin | 3' | m/44'/3' |
| Ethereum | 60' | m/44'/60' |
| Ethereum Classic | 61' | m/44'/61' |
| Cosmos | 118' | m/44'/118' |
| Solana | 501' | m/44'/501' |
| Cardano | 1815' | m/44'/1815' |
| Polkadot | 354' | m/44'/354' |
The full registry of coin types is maintained in SLIP-44 and contains over 1,000 entries.
Account
The account level allows users to create separate logical accounts within the same wallet, similar to having multiple bank accounts. Account 0' is the default:
m/44'/0'/0'— Bitcoin Account 0m/44'/0'/1'— Bitcoin Account 1m/44'/60'/0'— Ethereum Account 0
Accounts use hardened derivation, which means knowing the extended public key of one account does not reveal keys of another account. This provides privacy isolation between accounts.
Change
The change level distinguishes between:
- 0 (External chain) — Addresses given to others for receiving payments.
- 1 (Internal chain) — Addresses used by the wallet internally for returning change to yourself.
In Bitcoin's UTXO model, when you spend a transaction output, the entire output must be consumed. If you are sending 0.5 BTC from a 1 BTC output, the remaining 0.5 BTC is sent to a change address controlled by your wallet. The change chain keeps these addresses separate from receiving addresses for organizational and privacy purposes.
Ethereum and other account-based blockchains do not use the change chain in the same way, since they do not have a UTXO model. Ethereum wallets typically use only the external chain (change = 0).
Address Index
The address index is the sequential number of the address within a chain. Wallets increment this counter each time a new address is generated:
m/44'/0'/0'/0/0— First receiving addressm/44'/0'/0'/0/1— Second receiving addressm/44'/0'/0'/0/2— Third receiving addressm/44'/0'/0'/1/0— First change addressm/44'/0'/0'/1/1— Second change address
Derivation Paths for Major Cryptocurrencies
Bitcoin
Bitcoin uses multiple derivation paths corresponding to different address types:
| Standard | Path | Address Type | Prefix | Example |
|---|---|---|---|---|
| BIP-44 | m/44'/0'/0' | Legacy (P2PKH) | 1... | 1A1zP1eP5QGefi2DMPTfTL5SLmv7DivfNa |
| BIP-49 | m/49'/0'/0' | SegWit-compat (P2SH-P2WPKH) | 3... | 3J98t1WpEZ73CNmQviecrnyiWrnqRhWNLy |
| BIP-84 | m/84'/0'/0' | Native SegWit (P2WPKH) | bc1q... | bc1qw508d6qejxtdg4y5r3zarvary0c5xw7kv8f3t4 |
| BIP-86 | m/86'/0'/0' | Taproot (P2TR) | bc1p... | bc1p5d7rjq7g6rdk2yhzks9smlaqtedr4dekq08ge8ztwac72sfr9rusxg3297 |
Important for recovery: If you restore a seed phrase in a new wallet and do not see your balance, the wallet may be scanning a different derivation path than the one your original wallet used. Try toggling between Legacy, SegWit, and Taproot address types, or manually specify the derivation path.
Ethereum
Ethereum typically uses a single derivation path:
m/44'/60'/0'/0/0 — First account
m/44'/60'/0'/0/1 — Second account (some wallets)
However, some wallets (like Ledger Live) derive multiple accounts at the account level:
m/44'/60'/0'/0/0 — Account 0
m/44'/60'/1'/0/0 — Account 1
m/44'/60'/2'/0/0 — Account 2
While others (like MetaMask) increment the address index:
m/44'/60'/0'/0/0 — Account 1
m/44'/60'/0'/0/1 — Account 2
m/44'/60'/0'/0/2 — Account 3
This inconsistency can cause confusion during recovery. Always note which wallet software created your seed phrase.
Solana
Solana uses Ed25519 (a different elliptic curve than secp256k1) with the path:
m/44'/501'/0' — Phantom, Solflare
m/44'/501'/0'/0' — Some implementations
Cardano
Cardano uses a different key derivation scheme (Ed25519-BIP32 / CIP-1852) with the path:
m/1852'/1815'/0'/0/0 — First payment address
m/1852'/1815'/0'/2/0 — First staking key
Note the purpose field 1852' (CIP-1852, named after Ada Lovelace's birth year) instead of 44'.
Hardened vs. Normal Derivation
Understanding the difference between hardened and normal derivation is crucial for security.
Normal (Non-Hardened) Derivation
- Uses indices 0 through 2^31 - 1.
- Child public keys can be derived from the parent extended public key without the parent private key.
- Advantage: Enables watch-only wallets (e.g., a server can generate new receiving addresses using only the xpub, without ever holding private keys).
- Risk: If an attacker obtains both a child private key AND the parent extended public key, they can compute the parent private key and all sibling private keys.
Hardened Derivation
- Uses indices 2^31 through 2^32 - 1 (written as 0' through 2^31 - 1').
- Requires the parent extended private key to derive child keys.
- Advantage: Compromising a child key does not compromise the parent or siblings.
- Risk: Cannot derive child public keys from parent extended public key alone (no watch-only functionality at this level).
Why BIP-44 Uses Hardened Derivation for the First Three Levels
Purpose, coin type, and account are all hardened (44'/0'/0') because:
- Compromising an address private key (at the non-hardened level 5) should not compromise the account.
- Accounts should be isolated from each other.
- Different coins should be isolated from each other.
The change and address index levels are non-hardened (0/0) to allow watch-only wallets to generate receiving addresses without the master private key.
The Gap Limit
Wallets do not scan an infinite number of addresses. The BIP-44 specification introduces the concept of a "gap limit" — the number of consecutive unused addresses a wallet will scan before stopping. The standard gap limit is 20.
If you have generated addresses 0 through 25, but only addresses 0, 5, 10, and 25 have ever received funds, the wallet will:
- Scan address 0 — has transactions, continue.
- Scan addresses 1–4 — unused, but within gap limit.
- Scan address 5 — has transactions, reset gap counter.
- Continue until it encounters 20 consecutive addresses with no transactions.
Problem: If you generated many addresses beyond the gap limit (common with merchant payment processors), a wallet restoration might not find all your funds. You may need to increase the gap limit in the wallet settings during recovery.
Use the SafeSeed Key Derivation Tool to explore BIP-44 derivation paths interactively. Enter a seed phrase (use a test phrase, not your real one) and see how different derivation paths produce different addresses for different coins. All processing happens in your browser.
Extended Keys: xpub, ypub, zpub
Extended keys encode the key material along with metadata about the derivation path:
| Prefix | Standard | Address Type | Network |
|---|---|---|---|
| xpub / xprv | BIP-44 | Legacy (P2PKH) | Mainnet |
| ypub / yprv | BIP-49 | SegWit-compat (P2SH-P2WPKH) | Mainnet |
| zpub / zprv | BIP-84 | Native SegWit (P2WPKH) | Mainnet |
| tpub / tprv | BIP-44 | Legacy (P2PKH) | Testnet |
The prefix tells wallet software which address type to derive. If you export an xpub and import it into a wallet expecting a zpub, you will see different (incorrect) addresses.
Extended Public Key Privacy Warning
Sharing an xpub (or ypub/zpub) allows the recipient to:
- Derive all past and future receiving addresses.
- Track your complete transaction history and balance.
- Link your addresses together, destroying the privacy benefits of using a new address per transaction.
Never share extended public keys except with parties you fully trust with your financial privacy (e.g., your accountant, a watch-only wallet on your own server).
Common Derivation Path Problems
"I restored my seed phrase but my balance shows zero"
This is the most common derivation path issue. Possible causes:
- Wrong address type — You used SegWit addresses (BIP-84,
m/84'/0'/0') but the new wallet is scanning Legacy paths (BIP-44,m/44'/0'/0'). Switch address types. - Wrong coin type — Some wallets used coin type 0 for all coins in earlier implementations.
- Wrong account — You may have used account 1 or higher.
- Gap limit — Your used addresses were beyond the default gap limit of 20.
- Custom derivation path — Some wallets use non-standard paths.
"My two wallets show different addresses from the same seed phrase"
If two wallets generate different addresses from the same seed phrase, they are using different derivation paths or address types. Check the derivation settings in both wallets.
Recovery Checklist
When restoring a wallet from a seed phrase:
- Verify the wallet supports BIP-39.
- Select the correct address type (Legacy, SegWit, or Taproot).
- Check the derivation path matches the original wallet.
- Increase the gap limit if you used many addresses.
- Check all accounts (not just account 0) if you created multiple accounts.
Advanced: Custom Derivation Paths
Some advanced use cases require custom derivation paths:
- Multi-signature setups — BIP-48 defines derivation paths for multisig wallets:
m/48'/0'/0'/2'(for native SegWit multisig). - Lightning Network — Some Lightning implementations use custom derivation paths for channel keys.
- Privacy wallets — Wasabi and other privacy-focused wallets may use specific paths.
Always document the derivation paths you use. If you cannot reconstruct the exact path, you cannot recover the funds.
FAQ
What is a derivation path in cryptocurrency?
A derivation path is a structured notation that specifies how to derive a particular key or address from a master seed in a hierarchical deterministic (HD) wallet. It follows the format m/purpose'/coin_type'/account'/change/address_index, where each level narrows down to a specific key in the derivation tree.
Why do different cryptocurrencies use different coin types?
Different coin types ensure that the same seed phrase produces separate, unrelated keys for each blockchain. This prevents accidental cross-chain interference and ensures that compromising keys on one chain does not affect keys on another.
Can I use the same seed phrase for Bitcoin and Ethereum?
Yes. The same BIP-39 seed phrase can derive keys for both Bitcoin and Ethereum (and many other cryptocurrencies). They use different derivation paths — Bitcoin at m/44'/0'/0' and Ethereum at m/44'/60'/0' — so the derived keys and addresses are completely independent.
What does the apostrophe (') mean in derivation paths?
The apostrophe indicates hardened derivation. Hardened derivation requires the parent private key and provides stronger security isolation: compromising a child key does not reveal the parent or sibling keys. Non-hardened levels (without the apostrophe) allow child public key derivation from a parent public key.
Why does my wallet show zero balance after restoring a seed phrase?
The most common cause is a derivation path mismatch. Your original wallet may have used a different address type (Legacy vs. SegWit vs. Taproot), each of which uses a different derivation path. Try switching address types in the recovery wallet, or manually specify the derivation path used by your original wallet.
What is the gap limit and why does it matter?
The gap limit is the number of consecutive unused addresses a wallet scans before assuming no more addresses have been used. The BIP-44 standard sets this at 20. If you generated many addresses (e.g., for a merchant accepting payments), some funded addresses might be beyond the gap limit and invisible during recovery. Increase the gap limit in wallet settings to find them.
Do all wallets use BIP-44?
Most modern wallets support BIP-44 or its successors (BIP-49, BIP-84, BIP-86). However, some wallets use proprietary derivation paths. Electrum, for example, uses its own mnemonic and derivation scheme. Always document which wallet created your seed phrase and which derivation paths it uses.