Bitcoin Wallet Security Workshop

• ✅ Store seed phrases offline on paper or metal backups
• ✅ Never share your seed phrase with anyone—not even "support"
• ✅ Use hardware wallets for amounts you can't afford to lose
• ✅ Verify addresses character-by-character before sending funds
• ✅ Test backups with small amounts first before large transfers
• ✅ Use strong, unique passwords for exchange accounts
• ✅ Enable 2FA everywhere (preferably hardware key or authenticator app)

• ❌ Never store seeds digitally - no cloud, email, photos, or text files
• ❌ Never use predictable words - seeds must be truly random
• ❌ Never share private keys or seeds - even with family (use multisig instead)
• ❌ Never use untrusted wallet software - stick to well-known, audited wallets
• ❌ Never enter seeds on websites - legitimate services never ask for your seed
• ❌ Never screenshot seed phrases - images sync to cloud storage
• ❌ Never use public WiFi for Bitcoin transactions without VPN

Early Bitcoin wallets had no standard. Then standards appeared over time, each solving a problem. Think of it as versions, not competition.

Wallets did not "change their minds"—they adopted new standards as Bitcoin evolved. That's why an older wallet, a newer wallet, and a multisig coordinator may all use different paths by default.

This is where most recovery panic comes from.

Tools like Sparrow or Electrum allow you to try different paths, manually specify one, or scan multiple address types. They assume you may not know which wallet originally created the addresses.

Multisig wallets are shared agreements. Everyone must agree on: keys, script type, address format, and derivation paths.

If even one signer uses a different path or address type, the wallets no longer recognize the same coins.

That's why multisig setups always document: script type, derivation paths, and policy rules. This is not paranoia—it's coordination.

You may notice paths end with a number like /5 or /27. Wallets do this automatically.

Every time you receive Bitcoin:

• Wallet uses the next unused address
• Privacy improves (payments aren't linked)
• Address reuse is avoided

During recovery, wallets scan: Address 0, Address 1, Address 2... until they see no history.

This matters more than people think.

Wallet created with Native SegWit
Path: m/84'/0'/0'
Used with Sparrow
Multisig: 2-of-3

An output descriptor is a compact string that completely describes your wallet: script type, derivation path, and public key fingerprint. For multisig, it includes all co-signers' keys. Without it, recovering a multisig wallet from seeds alone is extremely difficult.

Single-signature native SegWit:

Components: wpkh = script type · a1b2c3d4 = master key fingerprint · /84h/0h/0h = derivation path · xpub... = extended public key

2-of-3 multisig (native SegWit):

All three co-signer public keys must be present. Losing this descriptor means you cannot reconstruct the wallet addresses even if you have all three seeds.

Sparrow saves a .json wallet file that contains the descriptor, address labels, and transaction history — but never your seed phrase or private keys.

Back up this file to an encrypted USB drive and a printed copy. Without it you can still recover funds from seeds + descriptor, but you lose address labels and history.

Extended public keys (xpubs) contain the same underlying key data. The prefix only signals the intended script type to wallet software. This causes frequent confusion during recovery.

Running Bitcoin Core gives you full sovereignty: you verify every transaction yourself instead of trusting someone else's server. The bitcoin.conf file controls how your node behaves.

After changing bitcoin.conf, restart Bitcoin Core. Connect Sparrow or Electrum Personal Server to your node via the RPC address and credentials above.