Skip to Content
DocumentationPlatformKeysKey Derivation

Key Derivation

The Vault derives wallet addresses from a master key using hierarchical deterministic (HD) derivation based on BIP-32 and BIP-44. Creating new wallets does not require a new DKG ceremony — addresses are derived mathematically from the existing master key.

A single master key produces valid addresses on every supported blockchain — all chains share the same secp256k1 curve, and each chain applies its own address encoding to the derived public key. Every derived address is secured by the same k-of-n threshold and signer set. The specific derivation paths are an internal implementation detail of the MPC coordinator.

What Derivation Requires

Deriving a new address is not a signing operation — it never involves a mobile device, human approval, or the full signing threshold:

  • A wallet’s first child key is computed server-side by the MPC coordinator from the existing key shares — no DKG, no mobile participation.
  • Additional account-based addresses (e.g. Ethereum, TRON) on an existing wallet are derived locally from that child key with no MPC interaction at all, so they are instant.
  • New UTXO (Bitcoin) addresses each derive a fresh child key via the coordinator.

Only the child public key is produced during derivation. Signing with the corresponding private key always requires the full k-of-n threshold and, for wallets with enrolled mobile signers, human approval on a paired device.

Capacity

HD derivation supports 2^31 child keys per level — effectively unlimited wallets and addresses from a single master key.

Running DKGRefresh & Recovery