<blockquote>
<p>Children created by these wallets are not hardened</p>
</blockquote>
<p>They are <code>m/44'|49'|84'/0'/0'</code> for trezor one/T and <code>m/49'|84'/0'/0'</code>   for ledger X/S. All subsequent children aren't hardened.</p>
<blockquote>
<p>If an xpub is leaked for a mnemonic phrase + passphrase, if you have
any of the children's private keys, you can compromise the entire
wallet linked to the xpub and all other children, hardened or
non-hardened BUT the attacker will not be able to compromise any other
meomonic phrase + paassphrase you have as it has a different xpub, and
ultimately different children</p>
</blockquote>
<p>This is the explanation from <a href="https://github.com/bitcoin/bips/blob/master/bip-0032.mediawiki#implications" rel="nofollow noreferrer">bip32</a>: <em>&quot;knowledge of a parent extended public key plus any non-hardened private key descending from it is equivalent to knowing the parent extended private key (and thus every private and public key descending from it). This means that extended public keys must be treated more carefully than regular public keys.&quot;</em></p>
<blockquote>
<p>I want to know how it's even possible to leak a childs private key on
a trezor or a ledger as none of the outputs are able to leak these</p>
</blockquote>
<p>Private keys should never leave hardware wallets without any extraordinary cause. Usually, only the master seed is transferable as a possibility from a hardware wallet device. And there are not many reasons to do so. If an attacker is able to backdoor your device and steal keys, the fact of sharing xpubs would be irrelevant.</p>

CC BY-SA 4.0
2021-03-03T16:31:24.183Z
Your last comment is exactly how I saw it. So it's almost safe (knowing the risks) giving out your xpub as the child keys are never leaked, therefore it makes no difference if a trusted 3rd party has it or not
Astie
CC BY-SA 4.0
2021-02-22T23:15:25.493Z
2021-02-22T23:15:25.493Z
Tony Sanak
<p>So some generalisations on xpubs and current wallet providers.</p>
<ul>
<li>Ledger and Trezor wallets can create xpubs which can show all transactions of a wallet</li>
<li>When a passphrase is added, this counts as a new set of private keys along with a new xpub</li>
<li>The children public addresses created from sending/receiving bitcoin are bound only to the xpub from the mnemonic phrase + passphrase i.e. if you create a new passphrased wallet it will have a new xpub</li>
<li>Children created by these wallets are not hardened</li>
<li>If an xpub is leaked for a mnemonic phrase + passphrase, if you have any of the children's private keys, you can compromise the entire wallet linked to the xpub and all other children, hardened or non-hardened BUT the attacker will not be able to compromise any other meomonic phrase + paassphrase you have as it has a different xpub, and ultimately different children</li>
</ul>
<p>My question, assuming the above is correct, it's becoming more commonplace for 3rd parties (i.e. tax tools) to make use of xpubs - I want to know how it's even possible to leak a childs private key on a trezor or a ledger as none of the outputs are able to leak these, unless I'm wrong.</p>
<p>Just want to make sure I'm not leaving myself too open.</p>

CC BY-SA 4.0
2021-02-16T23:22:32.827Z
If I am wrong with any of the above, please shout. Would love a comment as this is probably how the majority of retail access bitcoin.
Astie
<bitcoin-core><mnemonic-seed><passphrase><xpub>
HD Wallets, XPUB and child private key leaks
Astie
# HD Wallets, XPUB and child private key leaks

(Asked by: username_0 on 2021-02-14)

So some generalisations on xpubs and current wallet providers.

* Ledger and Trezor wallets can create xpubs which can show all transactions of a wallet
* When a passphrase is added, this counts as a new set of private keys along with a new xpub
* The children public addresses created from sending/receiving bitcoin are bound only to the xpub from the mnemonic phrase + passphrase i.e. if you create a new passphrased wallet it will have a new xpub
* Children created by these wallets are not hardened
* If an xpub is leaked for a mnemonic phrase + passphrase, if you have any of the children's private keys, you can compromise the entire wallet linked to the xpub and all other children, hardened or non-hardened BUT the attacker will not be able to compromise any other meomonic phrase + paassphrase you have as it has a different xpub, and ultimately different children

My question, assuming the above is correct, it's becoming more commonplace for 3rd parties (i.e. tax tools) to make use of xpubs - I want to know how it's even possible to leak a childs private key on a trezor or a ledger as none of the outputs are able to leak these, unless I'm wrong.

Just want to make sure I'm not leaving myself too open.

**Tags:** bitcoin-core, mnemonic-seed, passphrase, xpub

> **Comments:**
> **username_0**: If I am wrong with any of the above, please shout. Would love a comment as this is probably how the majority of retail access bitcoin.  

---

## 1 answers

### Answer by username_1 on 2021-02-22. Score: 0

> Children created by these wallets are not hardened

They are `m/44'|49'|84'/0'/0'` for trezor one/T and `m/49'|84'/0'/0'` for ledger X/S. All subsequent children aren't hardened.

> If an xpub is leaked for a mnemonic phrase + passphrase, if you have
> any of the children's private keys, you can compromise the entire
> wallet linked to the xpub and all other children, hardened or
> non-hardened BUT the attacker will not be able to compromise any other
> meomonic phrase + paassphrase you have as it has a different xpub, and
> ultimately different children

This is the explanation from [bip32](https://github.com/bitcoin/bips/blob/master/bip-0032.mediawiki#implications): *"knowledge of a parent extended public key plus any non-hardened private key descending from it is equivalent to knowing the parent extended private key (and thus every private and public key descending from it). This means that extended public keys must be treated more carefully than regular public keys."*

> I want to know how it's even possible to leak a childs private key on
> a trezor or a ledger as none of the outputs are able to leak these

Private keys should never leave hardware wallets without any extraordinary cause. Usually, only the master seed is transferable as a possibility from a hardware wallet device. And there are not many reasons to do so. If an attacker is able to backdoor your device and steal keys, the fact of sharing xpubs would be irrelevant.

> **Comments:**
> **username_0**: Your last comment is exactly how I saw it. So it's almost safe (knowing the risks) giving out your xpub as the child keys are never leaked, therefore it makes no difference if a trusted 3rd party has it or not  

---

