.pem file, the customer uploads it in the Fordefi Console, and Fordefi delivers the encrypted recovery package to the customer’s designated email address — or the customer downloads it from the console instead. CoinCover holds only the corresponding RSA private key, within our hardware-isolated key vault — never the key shares themselves.
Because CoinCover holds just a decryption key, recovery is a key return: CoinCover returns the RSA private key under verified conditions, and the customer decrypts the recovery package Fordefi delivered to them to regain access.
At a glance
Backup
The backup is driven from the Fordefi Console, with CoinCover and Fordefi confirming the public key over Slack at either end so both sides know exactly which key was used.1
CoinCover prepares the public key
CoinCover Tech Ops pull the customer’s RSA public key from the CoinCover API as a
.pem file. CoinCover support provides it to the customer and directs them to initiate backup in the Fordefi Console, then confirms with Fordefi over Slack which public key was provided.2
The customer initiates backup in the Fordefi Console
The customer uploads the public key in the Fordefi Console and designates a recovery email address to receive the backup. We recommend a dedicated recovery inbox, kept separate from everyday mailboxes — even if it were compromised, the contents are encrypted to CoinCover’s public key and can’t be used. A customer who would rather not use email can skip this and download the package from the console instead.
3
The customer validates on mobile with quorum approval
The customer validates the public key on their mobile device, then waits for the rest of the admin quorum to approve via mobile.
4
Fordefi builds and delivers the recovery package
Fordefi encrypts both key shares with the public key and assembles them into a recovery package, which it sends to the designated email address — or makes available to download from the Fordefi Console for customers who opted out of email. Fordefi then confirms back to CoinCover over Slack which public key was used and that the customer has received the material.
Unlike the other partners, the Fordefi recovery package bundles the wallet derivation paths in alongside the two encrypted key shares. Because those paths live inside the package, Fordefi generates a fresh recovery package every time a wallet is added to the account — sent to the designated inbox, or re-downloadable from the console.
Recovery
Recovery is a key return. CoinCover releases the RSA private key under verified conditions, and the customer runs Fordefi’s recovery tool themselves on an offline machine.1
Request recovery through CoinCover Control
Initiate a recovery request in CoinCover Control. Release is gated by identity verification and your approval policy. As part of the request you supply a public GPG key, which CoinCover uses to encrypt the recovery package in transit.
2
CoinCover releases the RSA private key
CoinCover releases the RSA private key from our hardware-isolated key vault and returns it to the customer securely, encrypted to the GPG public key they supplied. The customer decrypts it with their GPG private key to obtain the RSA private key.
3
Run the Fordefi recovery tool offline
On an offline machine, the customer places the Fordefi recovery tool, the encrypted key material (the
.json extracted from the backup .zip), and the CoinCover-provided private key into a folder, then runs the tool to produce an output.csv of the per-vault private keys.4
Move funds with the recovered keys
The customer uses the recovered keys to access their assets independently of Fordefi. ECDSA-based chains import into standard wallets; EdDSA-based chains (such as Solana, Sui, Aptos) use Fordefi’s dedicated recovery-tool commands to move funds.
What’s next
Utila
The API-based single-backup MPC integration.
Fireblocks
The workspace and device-share MPC integration.
BitGo
Backup and recovery across the BitGo self-custody wallet.
Partners overview
All CoinCover partner integrations.