I have a service where users can buy my product. Besides paying by card, I want to be able to allow users to pay in ETH. I think that it will correctly generate addresses for each user so that it is possible to follow the balance.On the sever I have run geth, and users get their addresses via the rpc request. But if someone is hacked server, he can withdraw all amounts. How can I can I provide secure wallet?

Any suggestions would be much appreciated.

1 Answer 1


You can use HD wallets. You'll be able to store your seed words safely offline, put the Master public key on a server and generate receiving addresses based on it.

This is how you can generate addresses based on a Master Public Key that corresponds to a base derivation path:

const wallet = require('ethereumjs-wallet')
const hdkey = require('ethereumjs-wallet/hdkey')

const create_addresses = async (from, to) => {

  const addresses = [];

  const master_public_key = process.env.MASTER_PUBLIC_KEY;

  const hdk = hdkey.fromExtendedKey(master_public_key);

  from = from || 0;
  to = to || 100;

  for (let i = from; i <= to; i++){
    const child = hdk.deriveChild(i);
    const w = wallet.fromExtendedPublicKey( child.publicExtendedKey() );
    const addr = {};
    addr[w.getAddressString()] = `${process.env.BASE_DERIVATION_PATH}/${i}`;

  return addresses;

Assuming the value found in process.env.MASTER_PUBLIC_KEY corresponds to the derivation path m/44'/60'/0, the above function, when called without any parameters will generate addresses from m/44'/60'/0/0 to m/44'/60'/0/100

Update - getting the master public key:

const get_mpk = ( seed, bdp ) => {
  const seed = bip39.mnemonicToSeed(mnemonic)
  const hdk = hdkey.fromMasterSeed(seed);

  const base_derivation_path = bdp || "m/44'/60'/0'/0";
  const base_derived = hdk.derivePath(base_derivation_path);
  const master_public_key = base_derived.publicExtendedKey();
  return master_public_key;
  • Thanks! Can you also provide how can I generate MASTER_PUBLIC_KEY. and than how do I withdraw recieved coins? Commented Oct 26, 2018 at 8:46
  • I've added the code that generates the MASTER_PUBLIC_KEY from seed words and derivation path. Unfortunately, I don't have the code to create and sign transactions in a single place (we're creating the tx online and sign it offline) and I don't have time to put it together now. Commented Oct 26, 2018 at 13:00
  • I just want to understand what I need to have to make transactions. How can I understood I need to have private key to make transaction form those adresses. But what private key I need to have ? And how can I use it ? Commented Oct 26, 2018 at 13:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.