Learn more about wallet migration here.
This method imports a single EVM wallet into Utila directly from its private key, using the Utila CLI on an air-gapped machine. It works for any standard EVM private key, including keys exported from retail wallets such as MetaMask, not just institutional MPC setups.
At Utila, we ensure that the migration process is carried out to the highest standards of security. Because this flow handles a raw private key, it must be performed on a secure, air-gapped (offline) machine, and that machine must be wiped once the process is complete.
Unlike the Fireblocks xprv/fprv flow, this method imports one EVM wallet, the single address that corresponds to the private key you provide. There is no derivation tree, so you do not need to create additional wallets or upload an address CSV afterward.
Before you begin
You will need:
The Utila CLI, obtained from your Utila Customer Success Manager (CSM).
An air-gapped (offline) machine to run the CLI.
A dedicated vault in Utila.
The hex EVM private key for the wallet you want to import.
Prerequisite: Download and run the Utila CLI
This step is required before starting the import flow. If you encounter issues, consult your internal IT team.
Determine the architecture of the offline machine where the Utila CLI will run.
Obtain the Utila CLI from your Utila CSM.
Copy the Utila CLI to the offline machine.
Run the CLI: Open a terminal on the offline machine and run the Utila CLI.
On Windows, you may need to click Run Anyway.
On macOS, approve the app under Privacy & Security > Open Anyway.
On Linux/macOS, you may need to run
chmod u+x <cli-filename>.
Confirm installation: Run the command:
utila-cli --help
Take a screenshot of the terminal output and send it to your Utila CSM. This confirmation is required to proceed.
Generate a secure QR code to transfer the keys
Run the Util CLI (provided by the Utila team).
When prompted for the xprv and fprv values, leave both empty. These apply only to the Fireblocks recovery flow
Enter your hex EVM private key instead.
Name the output file.
The CLI splits each key into two shares (one for Utila and one for the customer) and encodes them into the QR. The Utila share is encrypted with a public key which only Utila can decrypt, such that the QR itself does not contain the Utila share in plain
Import the keys into the Utila vault via QR scan
Open the Utila mobile app and select the new vault.
Select Import Wallet Keys, scan the QR and complete the process.
Once the QR is scanned, the Utila mobile app stores the customer share in secure storage and uploads the encrypted Utila share to the Utila backend. Your EVM wallet is now mirrored in the vault, and no further wallet creation is required.
And that's it, you should be good to go!
Last important note: Make sure to wipe your offline machine and any other hardware device you used during the process once the migration is complete.