Crypto Wallet Custody: HD Key Tree & Multisig Security

Wallet Structure

Addresses per signer 3

Multisig threshold M-of-5 3

No breach attempts yet. The wallet is at rest.

Live State

Addresses derived

Compromised keys

Signing security margin

100%

How it works

A hierarchical-deterministic (BIP-32) wallet derives every key from one master seed. Each derivation step is a one-way HMAC:

I = HMAC-SHA512(chainCode, parentKey || index)
IL, IR = split(I)
childKey = (parentKey + IL) mod n     (chain code = IR)

Knowing a child key never reveals the parent or the seed — but knowing the master seed reveals every key ever derived from it, forever. That is why the seed is the single highest-value target and belongs in cold storage: a device that has never touched the internet, so no remote exploit can reach it.

This wallet spreads spending authority across 5 independently-derived signer keys and requires a threshold M of them to agree before funds move:

valid transaction ⇔ |{ valid signatures }| ≥ M   (M-of-5 multisig)

An attacker who compromises fewer than M hot signer keys gains nothing — they cannot produce a quorum. Compromising the air-gapped master seed bypasses this entirely, since it can re-derive all signer keys at once, which is exactly why "cold storage + multisig" is treated as a stronger model than either control alone.

Addresses per signer — fan-out of the HD derivation tree; more addresses spread received funds without weakening any single key.
Multisig threshold — how many of the 5 signer keys must co-sign; raising it shrinks the attacker's blast radius per compromised key.
Air-gap toggle — cold (offline) vs hot (online, reachable) master seed.
Simulate breach — randomly compromises one reachable key and recomputes whether an attacker now holds a signing quorum.

Master seed (cold) Signer key (hot, safe) Compromised key

⚠ Couldn't load the 3D engineThree.js failed to load from the CDN. Check your connection and reload.