Use your Ethereum wallet

Ethereum and Bitcoin both use the secp256k1 elliptic curve. One private key produces the same public key on both, and only the address encoding differs. Connecting an EVM wallet therefore produces a Bitcoin address you already control, with nothing new to look after.

// 1. Connect the wallet the user already has
const [address] = await window.ethereum.request({
  method: 'eth_requestAccounts',
});

// 2. Sign the connection message. This is the only signature required.
const message = 'sigma-auth-connect:1:' + address.toLowerCase();
const signature = await window.ethereum.request({
  method: 'personal_sign',
  params: [message, address],
});

// 3. Hand the signature to Sigma. The private key never leaves the wallet.
await fetch('/api/wallet/connect', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({ chainId: 1, address, message, signature }),
});

window.ethereum is the injected browser wallet, so this path covers extension and in-app browser wallets. A Ledger or Trezor reaches it the same way, by being connected through one of those wallets rather than through its own desktop app.

What Sigma does with the signature

The public key is recovered from the signature and re-encoded as a Bitcoin address. Sigma never sees the private key, because it never needs to.

// 1. User signs message with ETH wallet
const message = "sigma-auth-connect:1:0xa640f4840e7002ba3c8c2677da6986a3a55db7b4";
const signature = await signer.signMessage(message);

// 2. Recover uncompressed ETH public key (65 bytes)
const ethPubkey = recoverPublicKey(message, signature);
// Example: 0x042f472d6c7063546f4deed237666feaa593c44d26...

// 3. Convert to BSV compressed format (33 bytes)
const bsvPubkey = PublicKey.fromString(ethPubkey, "hex");
// Automatically compresses: 02 or 03 prefix + 32 bytes X coordinate

// 4. Derive BSV address
const bsvAddress = bsvPubkey.toAddress().toString();
// Example: 195VnjXUbJ953Hcrkfc9boF5aDbQMrM4cF

Recovering the funds without us

The claim is only worth something if you can leave. For a software wallet that holds the key itself, this is the whole procedure.

# Your Ethereum private key controls the derived BSV address directly.

# 1. Export it from a software wallet that holds it.
#    In MetaMask: Settings > Security and Privacy > Reveal Private Key
#    A hardware device will not do this. See the note below.

# 2. Import that same key into any BSV wallet

# 3. The wallet derives the same address. Your funds are there.
#    No Sigma account required, and no permission to ask for.

A hardware device will not do step one, because it never releases a key. Recovery there means taking your recovery phrase into offline derivation tooling to obtain the account key, which gives up the protection the device exists to provide. Worth knowing before you pick the device path, not after.