How Custodial Services Can Issue Deposit Addresses Without Holding Private Keys

A software developer has published a Python package called chain-addresses that allows custodial services to generate cryptocurrency deposit addresses using only an extended public key, eliminating the need to expose private keys on internet-facing servers. The approach derives deposit addresses from an account-level extended public key, separating address issuance from spending authority entirely. Traditional methods that ask a node for a fresh address bundle key custody, address gap tracking, and wallet recovery into a single component reachable via HTTP, creating a broad attack surface. The package explicitly refuses hardened derivation paths and private key inputs, making the security boundary a verifiable code property rather than a configuration assumption. It supports multiple address encodings including Bitcoin P2WPKH, P2TR, and EVM formats, mapping a single derived public key to several address types.