Overview

Mobile Key Share Backup allows you to recover the mobile key share of users with signing privileges. In this context, Cold Wallet workspaces are somewhat different from warm Workspaces. The only two user roles with MPC Key Shares are Owner and Signer. Key Share Backup helps prevent losing access to company assets due to human or signing device errors.

Events where you lose access to your key share

The following events block your ability to sign transactions on your mobile device. However, you can use Key Share Backup to recover your key share in any of the following events:

• You make any changes to your device's biometric settings or lose your PIN code.
• You lose or damage your device.
• You replace your device.
• You delete the Fireblocks Cold Wallet mobile app from your device.
• You do not remember your passphrase.

Best practices to mitigate risks from these events

Fireblocks recommends having at least two users with signing privileges in your workspace besides the workspace Owner. Having more signers with functioning devices lowers the risk of losing access to company assets.

All users with signing privileges are required to create a recovery passphrase when they onboard to the Fireblocks Cold Wallet mobile app. They should store their passphrase in a secure location. They may need to enter their recovery passphrase if all workspace signing devices are damaged. It is important to have access to it for Key Share Recovery.

Learn more about the recovery passphrase and the implications of forgetting it, how to regain access to your key shares, and a safe way to reset it. Bear in mind that on cold workspaces, it is not possible to verify or reset your recovery passphrase, as the device is air-gapped.

Mobile Key Share Recovery for a non-Owner device

Re-enrolling signing devices

This Key Share Recovery method recovers key shares for non-Owner users who lose access to or damage their mobile device or Fireblocks mobile app. If a Signer device requires a reset:

1. Onboard a new signer user following the guide here. A full re-onboarding is required as new signatures must be pre-processed and then taken offline.
2. Delete the old signer user as outlined here.

Mobile Key Share Recovery for the workspace Owner’s device

Unlike a Key Share Recovery for a non-Owner device, a Key Share Recovery for an Owner device requires help from Fireblocks Support. Therefore, completing an Owner Key Share Recovery may take several business days, depending on support availability and SLA commitments.

There are two methods to perform a Mobile Key Share Recovery for an Owner’s device:

• Method 1: Using the Owner's recovery passphrase
• Method 2: Using the mobile device of another user with signing privileges

Method 1: Using the Owner's recovery passphrase

To recover the Owner's mobile key share, your workspace Owner can use their recovery passphrase.

If your Owner does not have access to their signing device because of the following:

• Changes to the device’s biometric setting or a lost Fireblocks app PIN code
• Lost or damaged device
• Deleted the Fireblocks mobile app from the device

Then complete the following steps:

1. Have a new device set up with the updated biometrics, and make sure it is set according to the Device requirements for Cold Wallet devices.
2. Use the linked form to ask Fireblocks Support to move Fireblocks to a new device.
3. Support team validates the request over a video conference call with the workspace Owner.
4. Support team activates recovery mode for the Owner. This may take up to several days based on the Fireblocks SLA.

   Note

   Activating recovery mode is subject to strict security screening by Fireblocks Support, including identification over a video conference call.

5. The Owner registers the new device, using the invitation sent to the Owner's associated e-mail. During the process, you will be asked to scan the QR code on the computer screen using the Fireblocks mobile app on the new device. 

Method 2: Using the mobile device of another user with signing privileges

This option allows you to temporarily make an existing Signer user become your new workspace Owner if you lose access to your Owner mobile passphrase or device.

To validate which workspace users are qualified, follow these steps:

1. Access your workspace user list in your Fireblocks Console. Go to Settings > Users.
2. Any Signer showing “Ready” under the Status column can be made into the temporary Owner when using this recovery method.
   

   Important

   We highly recommend that the user you select remembers their recovery passphrase. This process does not require knowing your original Owner’s passphrase. However, because the temporary owner may be the only user with signing privileges during this process, they must be prepared for the full range of events requiring a recovery passphrase to recover a key share.

Instead of needing your passphrase, this method relies on identifying the workspace owner or a legal representative in a video conference with Fireblocks Support. However, for that reason, it can take longer than other options.

1. Use this form to ask Fireblocks Support to change your workspace's Owner. The replacement Owner must be an existing user with signing privileges (Signer role) with an operational Fireblocks Cold Wallet mobile app.
2. Support validates your request through a conference call with both your existing Owner and the temporary Owner.
3. Support then adjusts your roles to reflect the temporary Owner. This can take several days based on our SLA.
4. The original Owner now appears as a Signer user in your Fireblocks Console.
5. The new Owner then navigates to Settings > Users and selects Delete user.
6. Create a new Signer user with Fireblocks Support by following the guide here.
7. The Signer user onboards a mobile device following the guide here.
8. Contact Support to change the workspace Owner back to the original Owner user.
9. Support validates your request using a conference call with both the temporary Owner and the original Owner that you want to restore.
10. Fireblocks Support changes workspace ownership. This may take several days based on our SLA.