Introduction
Using this feature, you can mirror your Fireblocks workspace by securely uploading your encrypted key shares to the Utila platform.
Your shares stay encrypted in transit.
Your mobile share can only be decrypted by you with your Fireblocks recovery passphrase.
Utila never reconstructs or holds your full private key.
Learn more about your options in Migrate wallets into Utila.
How this method compares to other methods
Utila offers three ways to mirror a Fireblocks workspace:
Direct recovery kit upload (this article). Self serve from the console. Utila generates a public key for your vault, you generate your Fireblocks recovery kit against it, and you upload the kit directly. No third party subscription, no offline machine, and your full private key is never reconstructed.
Station70 SWaT integration. For customers who already have a Station70 subscription.
Utila CLI. Reconstructs your extended keys on an air gapped machine. More operationally involved, and requires wiping the offline machine afterward.
How it works
When you create a vault for this migration, Utila generates a unique keypair for that vault. The private key is stored encrypted at rest and is only accessed from a trusted execution environment.
You take the vault's public key and use it when generating your Fireblocks recovery kit. In the resulting kit, your two server shares are encrypted with the Utila public key, and your client (mobile) share stays protected by your Fireblocks recovery passphrase.
When you upload the kit, Utila decrypts the server shares only inside the trusted execution environment, and sends the client share to your Utila mobile app, where you decrypt it with your Fireblocks recovery passphrase.
At no point does Utila reconstruct or see your full private key, and the mobile share is never decrypted on Utila's servers.
Prerequisites
You must have:
Admin access to your Fireblocks console, including the ability to generate a recovery kit (this typically requires admin quorum approval in Fireblocks).
Your Fireblocks recovery passphrase (the passphrase that protects your recovery kit).
The Utila mobile app, paired to your account.
Confirmation of whether the workspace you're mirroring is mainnet or testnet, as this affects the addresses that are generated.
Note. The Direct import from Fireblocks vault option is only visible to eligible accounts. If you don't see it during vault creation, contact your Customer Success Manager.
Step by step instructions
1. Create a vault for the migration
In the Utila console, create a new vault and select Direct import from Fireblocks.
2. Copy your Utila public key
Once the vault is created, the console displays the vault's public key. Use the copy button to copy it. You'll paste this into Fireblocks in the next step.
Tip: You can return to this screen and re-copy the public key at any point before the keys are imported.
3. Generate your Fireblocks recovery kit against the Utila public key
In your Fireblocks console, generate a recovery kit using the Utila public key you just copied, so the kit's server shares are encrypted to Utila.
4. Upload the recovery kit to Utila
Back in the Utila console, open your migration vault and upload the Fireblocks recovery kit. When prompted, indicate whether the vault mirrors a mainnet or testnet Fireblocks workspace.
Utila validates the kit and decrypts your server shares inside the trusted execution environment. If the upload fails, you'll see a specific error (see Troubleshooting) and can retry in the console without contacting support.
5. Decrypt your mobile share in the Utila app
After a successful upload, the vault updates to prompt you to open the Utila mobile app. Open the app, select the new vault, and enter your Fireblocks recovery passphrase to decrypt your client share.
6. Keys are imported
Once your mobile share is decrypted, Utila completes the key import and refresh automatically. Your vault keys are now active.
7. Create your wallets
With your keys active, recreate your wallets by uploading your Fireblocks wallet address CSV, or create wallets manually.
Importing a large number of addresses may take a few minutes.
And that's it. Your Fireblocks workspace is mirrored in Utila.
To start transacting on your mirrored wallets, make sure you have a Transaction Policy in place.
Troubleshooting
If the recovery kit upload fails, the console shows a specific reason so you can fix it and retry in place:
Corrupt or unreadable file. The kit archive couldn't be read. Re-download the kit from Fireblocks and try again.
Wrong share count. The kit doesn't contain the expected shares. Confirm you generated a complete recovery kit.
Unsupported key type. The kit's key format isn't supported.
Public key mismatch. The kit wasn't generated against this vault's public key. Re-copy the public key from the vault (Step 2) and regenerate the kit in Fireblocks.
Retrying reuses the same vault public key, so you don't need to create a new vault.