Introduction
Derivation paths and HD (hierarchical deterministic) standards are the plumbing behind why the same seed phrase can produce thousands of addresses across Bitcoin, Ethereum, Solana, and other blockchains. If you plan to import a wallet to a hardware wallet, use a custom derivation path, or connect your hardware wallet to third-party software (for example, connecting to MetaMask), understanding these standards prevents missing funds and unexpected behavior.
In my testing, the most common problem I see is a mismatch in derivation path settings — not a faulty device. And yes, this can be confusing at first.
What is a derivation path?
A derivation path is a human-readable way to describe which branch of keys an HD wallet will produce from a single master seed. It looks like this: m/44'/0'/0'/0/0. Each number or level controls a decision: which standard, which coin, which account, change vs receive, and which address index.
Why does this matter? Because two wallets created from the same seed phrase can show different addresses if they use different paths.
BIP-39: seed phrase → seed
BIP-39 defines how a seed phrase (the list of 12 or 24 words you write down) becomes a binary seed. The standard also supports an optional passphrase (sometimes called a 25th word when a device offers that UX). BIP-39 uses PBKDF2 with HMAC-SHA512 to turn the phrase and passphrase into a 512-bit seed.
In my experience, most wallet issues boil down to either an incorrect seed phrase entry, a forgotten passphrase, or using a different derivation path than expected. See the seed phrase basics guide for more background: [/seed-phrase-basics].
BIP-32: HD wallets and hardened keys
BIP-32 defines hierarchical deterministic key derivation: starting from a master private key, you can derive child keys in a tree structure. The notation uses an apostrophe (') to indicate hardened derivation (m/0' is hardened). Hardened vs non-hardened matters for security and for whether an extended public key (xpub) can derive child public keys without the private key.
Short sentence. Longer one now: hardened children prevent an attacker with an xpub and one child private key from reconstructing the parent private key; non-hardened children allow public derivation and are convenient for account sharing (but with trade-offs).
BIP-44 and common derivation paths (examples)
BIP-44 is a widely adopted convention that layers on BIP-32/BIP-39. Its template is:
m / purpose' / coin_type' / account' / change / address_index
- purpose' = 44' for the BIP-44 standard (other purposes exist, e.g. 84' for native segwit)
- coin_type' is defined by SLIP-44 (e.g., 0' for Bitcoin, 60' for Ethereum, 501' for Solana)
Examples:
- Bitcoin (legacy-style BIP-44): m/44'/0'/0'/0/0
- Ethereum common path: m/44'/60'/0'/0/0
- Solana common path: m/44'/501'/0'/0/0
These are examples — different wallets or newer account schemes may use purpose 84' or 49'. But the coin_type and account structure explain why two wallets can show different addresses for the same seed.
Custom derivation and importing wallets (Step by step)
How do you import MetaMask accounts to a hardware wallet or otherwise use a custom derivation path? Here's a step-by-step checklist I use when moving accounts between wallets.
Step by step: importing an account with a custom derivation path
- Find the source wallet's derivation path. Many wallets expose this in account or advanced settings; browser wallets often show the path when you export or connect. (If you can't find it, look for FAQ or advanced export options.)
- On the destination app (hardware wallet companion app or third-party wallet), select "Import" or "Connect hardware wallet" and choose the option to enter a custom derivation path.
- Enter the exact path (e.g., m/44'/60'/0'/0). Double-check for hardened marks (').
- Let the app scan addresses. If nothing appears, increase the address index or gap limit (some apps only scan the first 20 addresses by default). But small transfers are a good test before moving large balances.
And remember to protect your seed phrase and any passphrase used during this process. If you use a passphrase, you must record it separately (see [/passphrase-usage-risks]).
For guidance on connecting to MetaMask specifically, see the guide on connecting to MetaMask: [/connect-metamask-web3].
How to derive addresses from a seed (practical)
High-level steps (no code required):
- Convert the BIP-39 seed phrase (+ optional passphrase) into the binary seed using PBKDF2-HMAC-SHA512.
- Use BIP-32 to derive the master private key from that seed.
- Follow the chosen derivation path (BIP-44 or custom) to derive account and address-level keys.
- Convert child public keys to blockchain addresses according to the chain's address format (e.g., P2PKH, Bech32, or Ethereum's hex address).
If you need to derive addresses manually for recovery or verification, use a trusted, offline tool or an air-gapped setup. See our guide on air-gapped signing for secure options: [/air-gapped-signing].
Troubleshooting: missing funds after restore or import
Common causes when funds don't show up:
- Wrong derivation path. This is the number one cause.
- Passphrase mismatch. The optional passphrase is required to reproduce the same seed-derived keys.
- Insufficient address scan range. The wallet didn't scan deep enough (increase the gap limit).
- Different address type (e.g., native segwit vs legacy) used by the original wallet.
But you can usually resolve this by checking the original wallet's settings, confirming the path and passphrase, and then re-importing or adjusting the scan settings. If that fails, our recovery walkthrough may help: [/restore-recover-failure].
Security considerations: passphrase (25th word) and xpubs
Using a passphrase adds strong protection because it creates a separate logical wallet from the same seed. However, it also increases the risk of permanent loss if the passphrase is forgotten. I believe the trade-off should be evaluated: strong protection vs recoverability.
Exporting xpubs to third-party software is usually safe for read-only balance monitoring, but an exposed xpub reveals your entire address set (privacy risk). Always pair xpub exports with firmware checks and trustworthiness of the third-party app (see [/third-party-compatibility]).
Quick comparison: BIP-32 vs BIP-39 vs BIP-44
| Standard |
Purpose |
Key concept |
Typical use case |
| BIP-39 |
Seed phrase -> seed |
Mnemonic words and optional passphrase produce a seed |
User backups and recovery |
| BIP-32 |
Key derivation tree |
Master key -> child keys (hardened/non-hardened) |
Wallet key generation and xpubs |
| BIP-44 |
Path convention |
Standardized path structure using purpose'/coin_type'/account' |
Multi-coin wallets and cross-wallet compatibility |
(alt text: Derivation path diagram (placeholder))
FAQ
Q: Can I recover my crypto if the device breaks?
A: Yes — if you have the correct seed phrase and passphrase (if used), you can restore to any compatible hardware or software wallet. See [/restore-recover-failure] for step-by-step guidance.
Q: What happens if the company behind a wallet goes bankrupt?
A: Your private keys live with you (non-custodial). As long as you have your seed phrase and passphrase, you can recover funds elsewhere. But companion apps and services may change, so plan for app-independent recovery.
Q: Is Bluetooth safe for a hardware wallet?
A: Bluetooth adds convenience but expands the attack surface. If you prioritize security, prefer wired or air-gapped signing and limit Bluetooth use. See connections and security guidance: [/connections-usb-bluetooth-nfc].
Q: Why do I see different addresses when I restore my seed?
A: Different wallets may use different derivation paths, address types, or account indexing. Confirm the exact path and passphrase used originally.
Q: How do I import MetaMask accounts to a hardware wallet?
A: Connect the hardware wallet via the third-party wallet UI, select the correct derivation path (MetaMask commonly uses an m/44'/60' based path), and choose the account addresses to import. Always verify addresses on-device and test with a small transfer. See [/connect-metamask-web3].
Final notes and next steps
Derivation paths are the unsung mapping between a single seed phrase and the many addresses you control. If you follow a careful checklist — confirm the derivation path, record any passphrase, test with small transfers, and keep an offline backup — you'll avoid most headaches.
If you're setting up a device, start with the basics: seed phrase handling [/seed-phrase-basics], passphrase decisions [/passphrase-usage-risks], and companion app setup [/getting-started-setup]. But remember: every extra feature (custom derivation, passphrase, third-party xpub exports) adds both utility and responsibility.
Ready to apply this? Get started with the setup overview here: [/setup-overview].
