Deterministic Wallet Restoration: Why Your XMRWallet Seed Generates Different Addresses Than Monero GUI

A Monero user imports their 25-word recovery seed into XMRWallet and immediately notices a problem: the wallet shows a different address than the one displayed in Monero GUI, Monero CLI, or another implementation. The seed phrase is identical. The wallet software is legitimate. Yet the public address—and sometimes the transaction history—does not match. This is not a bug in either application. It reflects a critical technical detail in how deterministic wallets derive cryptographic keys from seed material, a process that appears simple but contains several decision points where different implementations can legitimately diverge.

Understanding why this happens requires examining the exact path from seed phrase to private keys, how different Monero implementations interpret that path, and what verification steps confirm that restoration is working correctly. The issue matters because a mismatch between wallets can lead users to believe funds are missing, cause them to restore from backup repeatedly, or prompt them to move coins to what they think is a restored address—when in fact they should verify the derivation process before transferring anything.

The seed phrase and the first derivation step

A Monero 25-word recovery seed is encoded using the electrum word list, a standardized dictionary of 1626 words designed to reduce transcription errors and provide checksums. The seed itself is typically 256 bits of entropy, with an additional checksum word that validates the phrase as a whole. When a user enters this phrase into any Monero wallet, the first step is always the same: convert the word list into the corresponding binary seed.

This conversion is deterministic. The electrum list has a fixed order, and each word maps to a specific position within that list. The first word “abbey” always encodes to the same numerical value, “ability” always encodes to a different value, and so on. Any competent Monero implementation will produce identical binary seed material from the same word list. This is the foundation of deterministic restoration: the same phrase input will always produce the same starting bytes.

The verification step at this stage is straightforward but often skipped. Users can check that the seed phrase they enter is accepted by multiple implementations and that the checksum is valid. Most wallets will reject an incorrectly entered phrase with a checksum error before proceeding. If the phrase is accepted by one wallet and rejected by another, the phrase itself is the likely problem, not the key derivation logic.

Beyond this point, however, the path diverges. The binary seed is now subject to a derivation process that generates the actual private keys used to control funds. This is where view key and spend key generation differ between implementations, and where restoration can produce what appears to be a completely different wallet.

View key and spend key derivation: The critical difference

Monero uses two private keys to control each wallet: the spend key determines who can authorize transactions and move coins, while the view key

The original Monero reference implementation (Monero GUI and Monero CLI) uses a specific derivation formula: the binary seed is hashed using Keccak-256 to produce the spend key, and then the spend key is hashed again to produce the view key. This is sometimes called the “standard” or “primary” derivation path. Importantly, the Monero reference implementation also supports a secondary address space called subaddresses, where additional public addresses are deterministically derived from the view key and spend key pair using a specific mathematical formula.

XMRWallet implements the same fundamental approach but may handle edge cases, hashing parameters, or subaddress index calculations differently. If XMRWallet hashes with different input, uses a different hash output truncation method, or applies a different offset to subaddress indices, the resulting private keys will be completely different. The seed phrase “stays the same,” but the cryptographic material it generates diverges immediately downstream.

The reason this matters operationally is that a user exporting their spend key and view key from one wallet cannot simply paste them into another and expect the address to match. The address is computed from the keys using another mathematical step. If the keys are different, the address is different. If the address is different, a blockchain scan using that address will not find the same transaction history.

Subaddress indices and transaction history

Even if two implementations correctly derive the same primary spend and view key, they may still display different addresses if they interpret subaddress indices differently. A Monero wallet typically uses the primary address (index 0) as the default, but it can also generate unlimited additional addresses. Each additional address corresponds to a numeric index, and the wallet tracks which index was used for each incoming transaction.

If XMRWallet interprets subaddress index 1 as the second address while Monero GUI interprets it as the first, a user might see completely different transaction histories. The transactions would actually be in the Monero blockchain and belong to the wallet, but each implementation would be looking at a different subset based on the address it believes should receive payments.

Some implementations also differ in how they handle the “change” addresses used when spending. When a user sends Monero, the transaction often creates a change output—coins returned to the sender. The wallet must decide which subaddress receives this change. If two wallets make different decisions about which subaddress index to use for change, they will scan for different transactions and report different balances. Over time, this divergence can accumulate significantly.

XMRWallet, like the reference implementation, uses deterministic derivation, which means the same seed will always produce the same sequence of subaddresses in the same order. However, if the underlying key derivation differs, the entire sequence will be offset. A user importing a seed should expect either all addresses to match or none of them to match, not a partial overlap.

Verifying correct restoration across implementations

The safest verification approach is the spend key export. Both XMRWallet and Monero GUI allow exporting the private spend key in hexadecimal format (and in Monero’s case, the view key as well). A user can follow this procedure: first, export the spend key from the original wallet where they created the seed; second, check that XMRWallet displays the same spend key when the seed is restored; third, export the spend key from XMRWallet and compare it byte-for-byte with the original.

If the spend keys match exactly, the key derivation is correct and any address mismatch is the result of a downstream difference in how addresses are computed or indexed. If the spend keys do not match, the two wallets are using different derivation formulas, and funds sent to one address will not be recognized by the other.

A second verification layer is the view key. Some wallets export this separately, and comparing it across implementations serves the same purpose as comparing spend keys. If both keys match, restoration is working correctly, and the user can then debug the address or transaction history mismatch separately.

For users concerned about correctness, the official sites.google.com/xmrwallet.cfd/xmrwallet-official documentation provides the specific derivation formula used, allowing technically inclined users to verify the process manually or check against the source code. A user should not trust a wallet’s claim that “restoration works correctly” without performing these checks, especially if significant funds are involved.

Why different derivation paths exist

The fragmentation in deterministic wallet restoration is partly historical. Monero was created in 2014, and different wallet projects have implemented recovery functionality at different times and with different design decisions. The reference implementation did not always prioritize ease of restoration across wallets, and some implementations chose to add their own enhancements or security layers that made them incompatible with others.

Some wallets also intentionally use different derivation to prevent accidental mixing. If a user’s seed is compromised, an attacker cannot immediately load it into any random wallet and steal the funds; instead, the attacker would need to know which specific implementation was used. This provides a modest security benefit (security through obscurity), though it comes at the cost of reduced fungibility and increased user confusion.

Another reason for divergence is the choice of hash function or parameters. Monero has used Keccak-256 as its standard, but some alternative implementations have experimented with different hashing schemes or key stretching methods. These are not bugs—they are deliberate design choices. The consequence, however, is that a user cannot assume portability between any two Monero wallets without verification.

The real-world impact is that seed phrases in Monero are not portable in the way that Bitcoin’s BIP39 standard attempted to make them. A Bitcoin seed can typically be restored in any BIP39-compatible wallet and produce the same address. Monero’s 25-word phrase is designed for Monero specifically, but it is not standardized across all implementations. This is one of the reasons why Monero users should be thoughtful about which wallet they use and should back up not just the seed, but also the keys themselves and metadata about which implementation was used.

Practical steps if your restored address does not match

If a user restores their seed in XMRWallet and the address does not match the original, the first step is to verify that the seed phrase is correct. Re-enter it slowly, confirming each word against the original written copy. A single character error in any word will produce an entirely different seed and a completely different wallet.

Second, export the private spend key (and view key if available) from both wallets and compare them byte-for-byte. If they match, the key derivation is correct. If they do not match, XMRWallet is using a different derivation path than the original wallet, and the seed cannot be reliably restored in XMRWallet. In that case, the user should continue using the original wallet or investigate third-party tools that claim to support both derivation paths.

Third, if the keys match but the address is different, the issue is downstream from key generation. This could indicate a difference in how subaddress indices are calculated or how the wallet displays the primary address. A user should check whether the original wallet and XMRWallet agree on the balance and transaction history for a known received payment. If they do agree, the wallet is functioning correctly and the address difference is a cosmetic display issue or a subaddress index offset.

If the keys match, the address appears different, and the balances do not match, the most likely explanation is that the original wallet and XMRWallet are using different subaddress derivation formulas. In that case, the user may need to use a third-party tool that supports the original derivation method, or they may need to manually scan the blockchain using the exported keys to confirm which addresses actually received funds.

A critical safety rule: do not send funds to an address that does not match the original wallet until you have confirmed that the keys are identical and the wallet is scanning the correct transactions. An incorrect address, even one derived from the same seed, belongs to a different wallet, and sending coins there will not recover them.

The non-custodial responsibility and wallet selection

Because XMRWallet is non-custodial and employs no server-side password storage, the responsibility for correct key derivation falls entirely on the user. No support team can reverse a key derivation error or recover coins sent to the wrong address. This is the trade-off of non-custodial design: maximum privacy and control, but also maximum personal responsibility.

When selecting a Monero wallet, a user should prioritize wallets that clearly document their key derivation method and provide straightforward key export functionality. The fact that a wallet accepts a seed phrase does not guarantee that it will restore the same keys as another wallet. Wallets should be evaluated on their transparency about this limitation, not on their marketing claims about “compatibility.”

Users who hold significant amounts of Monero should test restoration before they need it. Create a test wallet, back up its seed phrase, delete the wallet, restore it, and verify that the keys and address match. This practice, performed with a small amount of funds before scaling up, can prevent expensive mistakes.

The broader lesson is that deterministic restoration is a powerful feature because it allows recovery from a seed phrase, but it is only as powerful as the specificity of the derivation standard. Monero’s ecosystem has not achieved the level of standardization seen in Bitcoin, and users should not expect universal portability. Understanding the technical underpinnings—view key and spend key derivation, subaddress indexing, and key export—is the reliable way to verify that restoration is working correctly.