<p>If the above two keys are leaked, then your master private key at the account level (m/44'/60'/4') can be back-calculated. That means, <strong>any private key</strong> (both receiving and change) that you derive from that account is compromised.</p>

<p>To elaborate, <a href="https://github.com/bitcoin/bips/blob/master/bip-0044.mediawiki" rel="nofollow noreferrer">BIP 44</a> uses non-hardened derivation to derive private keys after the account level. The child private key derivation equation is <code>kchild = kpar + hash(Kpar, cpar, i)</code>. Here <code>k</code> represents private key, <code>K</code> represents public key, <code>c</code> is chain code and <code>i</code> is the index. Now, since your <code>xpub</code> at m/44'/60'/4' is leaked, the attacker has <code>Kpar</code> (first 256 bits of <code>xpub</code>) and chain code, <code>c</code> (latter 256 bits of the <code>xpub</code>). Since your child private key (m/44'/60'/4'/0) is also leaked, that means the attacker has <code>kchild</code>. Using the above equation the attacker can simply back-calculate kpar. Even if he doesn't know the index number (0 in your case), the attacker can simply run an iteration (just a space of 2<sup>31</sup> to exhaust).</p>

<p>Since your parent private key at the account level is compromised, you cannot use any addresses derived from the m/44'/60'/4' account unless you want to lose your bitcoins. However, you can safely use m/44'/60'/5' or other accounts. </p>

CC BY-SA 4.0
2019-09-24T15:13:48.583Z
2019-09-24T15:13:48.583Z
Ugam Kamat
<p>Let's say the following keys are leaked:</p>

<ul>
<li>Extended public key derived from path 44'/60'/4'</li>
<li>Leaked child private key from path 44'/60'/4'/0</li>
</ul>

<p>Does that imply all the child private keys of the root 44'/60'/4' can be computed? Looking and reading at the BIP32 and BIP44 - that doesn't seem to be the case. But wanted to confirm.</p>

<p>Also, if we know that it doesn't cause the sibling keys to be derived, then can I go and safely use the following public key of path 44'/60'/4'/1 without any worries?</p>

<wallet><bip32-hd-wallets><deterministic-wallets><bip44>
What are the consequences from the leak of xpub and child private key?
Sibi
# What are the consequences from the leak of xpub and child private key?

(Asked by: username_0 on 2019-09-24)

Let's say the following keys are leaked:

* Extended public key derived from path 44'/60'/4'
* Leaked child private key from path 44'/60'/4'/0

Does that imply all the child private keys of the root 44'/60'/4' can be computed? Looking and reading at the BIP32 and BIP44 - that doesn't seem to be the case. But wanted to confirm.

Also, if we know that it doesn't cause the sibling keys to be derived, then can I go and safely use the following public key of path 44'/60'/4'/1 without any worries?

**Tags:** wallet, bip32-hd-wallets, deterministic-wallets, bip44


---

## 1 answers

### Answer by username_1 on 2019-09-24. Score: 1 | Accepted answer

If the above two keys are leaked, then your master private key at the account level (m/44'/60'/4') can be back-calculated. That means, **any private key** (both receiving and change) that you derive from that account is compromised.

To elaborate, [BIP 44](https://github.com/bitcoin/bips/blob/master/bip-0044.mediawiki) uses non-hardened derivation to derive private keys after the account level. The child private key derivation equation is `kchild = kpar + hash(Kpar, cpar, i)`. Here `k` represents private key, `K` represents public key, `c` is chain code and `i` is the index. Now, since your `xpub` at m/44'/60'/4' is leaked, the attacker has `Kpar` (first 256 bits of `xpub`) and chain code, `c` (latter 256 bits of the `xpub`). Since your child private key (m/44'/60'/4'/0) is also leaked, that means the attacker has `kchild`. Using the above equation the attacker can simply back-calculate kpar. Even if he doesn't know the index number (0 in your case), the attacker can simply run an iteration (just a space of 231 to exhaust).

Since your parent private key at the account level is compromised, you cannot use any addresses derived from the m/44'/60'/4' account unless you want to lose your bitcoins. However, you can safely use m/44'/60'/5' or other accounts.


---

