This is a real, browser-native HD wallet demo. Every key is computed with crypto.subtle — nothing is faked or pre-scripted. Each derivation step is a genuine one-way HMAC, chained so a child's output becomes the next level's HMAC key (a BIP-32-style construction, using SHA-256 as a stand-in for SHA-512):
childKeyBytes = HMAC-SHA256(parentKeyBytes, "idx:" + index)
Because HMAC is deterministic, re-deriving the exact same seed + path twice on this page produces the identical 32-byte output — verified on load and printed to the log. Because it is one-way, a leaked child key never reveals its parent. But the master seed is the root HMAC key for the whole tree: anyone holding it can genuinely recompute every signer and address key instantly, which is exactly what "Compromise master seed" does — it does not just recolor nodes, it re-runs the real derivation for the whole tree and checks the new output still matches.
Separately, the multisig panel generates 5 independent real ECDSA (P-256) key pairs via crypto.subtle.generateKey. A simulated transaction is only authorized once crypto.subtle.verify genuinely confirms at least M real signatures. Marking a seed "compromised" gives the attacker that seed's real private key — but forging with fewer than M compromised seeds still fails, because the attacker has no way to produce a signature that verifies against the honest seeds' public keys.
- Addresses per signer — fan-out of the HD derivation tree; rebuilding it re-derives every address key.
- Compromise master seed — re-derives and marks every node in the tree, proving the single point of failure.
- Multisig threshold — how many of 5 independent signatures a transaction genuinely needs.
- Forge attempt — only the checked ("compromised") seeds contribute a real signature; the rest are withheld, so the honest verify count falls short unless enough seeds are checked.