The Seed

In the summer of 2013, an IT worker in Newport, Wales, cleared out a desk and dropped a small hard drive into a black bin bag. James Howells had two identical drives; the one that went to landfill held the private keys to 8,000 bitcoin he had mined for pennies in 2009. What followed was a twelve-year siege of the tip: excavation schemes, drone surveys, robot dogs, investor consortiums, an offer of £25 million to the council — all refused. In January 2025 the High Court ended it, ruling that the drive had become the council's property the moment it hit the pit and that his claim had no realistic prospect of success. The coins are still there in the ledger, visible to everyone and spendable by no one, under a hundred thousand tonnes of Welsh refuse.

Howells lost a file. You should never have to, because the modern wallet reduced the thing you must keep to twelve or twenty-four words. The standard is BIP39, and its mechanics fit in a paragraph. Take the entropy from Module 3 — 128 bits for twelve words, 256 for twenty-four. Compute its SHA-256 hash and append the first few bits as a checksum: one bit per 32 bits of entropy, so 4 or 8. Slice the result into 11-bit chunks — 132 bits make twelve, 264 make twenty-four — and use each chunk, a number from 0 to 2,047, to pick a word from a fixed list of 2,048. That is the whole trick. The words are the number; they add nothing and hide nothing. And the checksum only catches transcription errors — it is an integrity aid, not a security feature.

From the words, everything else grows deterministically. The mnemonic is stretched through PBKDF2-HMAC-SHA512 — 2,048 rounds, salted with the string "mnemonic" plus your optional passphrase — into a 512-bit seed. BIP32 then feeds that seed to HMAC-SHA512 keyed with the phrase "Bitcoin seed": half the output becomes the master private key, half a "chain code" that rides along the tree. From that master, the wallet derives child keys, grandchildren, whole branches — millions of addresses if you want them, every one recomputable from the same words, in the same order, forever. This is the quiet revolution of hierarchical deterministic wallets: back up once and you have backed up every address the wallet will ever create. Before BIP32, wallets held loose bags of independent random keys, and a stale backup silently lost coins.

A derivation path is the address of a key within that tree, written like m/84'/0'/0'/0/0 — read it as standard (84 means BIP84, today's native-SegWit default), coin, account, receive-or-change, and finally the address index. The apostrophes mark hardened levels, and they exist for a concrete reason: an xpub — the watch-only public branch you might hand to a portfolio app — plus any one leaked non-hardened child private key is enough to reconstruct the parent private key by simple arithmetic. Hardened derivation mixes the parent's private key into the computation and slams that door shut, which is why account levels are always hardened and only the outermost address levels are not. The path is not a secret; it is a map.

That map explains the most common heart-stopping moment in Bitcoin: the restore that shows zero. A seed restored into new software often "loses" coins that are merely unscanned. One seed usually contains several trees at once — legacy, wrapped SegWit, native SegWit, Taproot — and a wallet that scans only its own preferred path reports an empty balance for all the others. Recovery scans also observe a gap limit, conventionally 20: if twenty consecutive addresses show no history, scanning stops, so coins parked deep in a sparsely-used account can sit invisible. In both cases nothing is gone. The keys still derive; the coins still sit in the ledger; the software just did not look where they are. The cure is a wallet pointed at the right derivation path — never a hasty conclusion.

The passphrase — BIP39's optional "thirteenth or twenty-fifth word" — deserves respect from both directions. Mixed into the seed derivation as part of the salt, every distinct passphrase opens a completely different wallet, and every passphrase is valid. That is power: a thief holding your metal seed backup finds only a decoy, and funds behind strong passphrases survived even the Coldcard sweep. It is also the sharpest footgun in custody. There is no checksum on a passphrase, no error message, no "wrong password" screen. Mistype it and a wallet opens normally — a different, empty wallet, which users routinely misread as theft. Forget it and your coins are exactly as unreachable as the thief's would have been. It splits your secret in two; you must now keep both halves alive.

Hold the module's inversion firmly: the words are the wallet, and the device is disposable. A drowned phone, a bricked signer, a lost hardware wallet — inconveniences, so long as the words survive on something sturdier than paper and memory. Stefan Thomas, paid 7,002 BTC in 2011 for making an early explainer video, keeps its keys on an encrypted IronKey that allows ten password guesses; he has used eight. His loss predates good seed practice — metal-stamped BIP39 words are the designed answer to exactly his failure, and to Howells'. But the corollary from Module 3 cuts the other way: derivation is deterministic, so words born from bad entropy are bad forever. No firmware update, no new device, no re-import can repair a badly-born seed. The only fix is a fresh seed and an on-chain move.