BIP32 private root that can derive the entire HD wallet keychain; compromise of an xprv exposes all descendant keys, must be stored with strong protection or hardware isolation.