A custody recovery drill that never exposes a key
A custody recovery drill produces four numbers and a list. The time from “go” to a verified extended public key. The count of keysets in the backup against the count in the live workspace. The count of known wallet addresses that failed to re-derive from the recovered keys. The value held in positions a sweep cannot touch. And every place the written procedure and reality disagreed. Everything else about the drill is staging for those five outputs, and none of them requires a private key to exist outside the recovery tool’s memory.
That last point is the one that gets drills cancelled. The standard objection is security: “we don’t want to handle live key material more often than we must.” Correct instinct, wrong conclusion. I have read the verify paths of the recovery tooling most MPC custody customers would use, and in the Fireblocks Recovery Utility the difference between verifying and recovering is one boolean, dangerouslyRecoverPrivateKeys, false on the Verify page. The private key is reconstructed in memory, its public key is compared against the backup’s own record, and the private half is deleted from the result before anything reaches the screen. The drill’s rule is that the line is never crossed. If a step would print or export a private key, it is not part of the drill. Everything up to that step is.
That rule has a useful side effect. Because nothing sensitive is produced, the drill can be run by more people, more often, and witnessed by people who would never be allowed near a real recovery. That is how procedures get found wrong.
Where the findings come from
Rarely from the cryptography. The reconstruction either matches or it does not, and it usually matches. The findings come from retrieving the inputs the way they would really be retrieved: the backup archive from its actual storage, the recovery key from its actual escrow, the passphrases through their actual access procedure. That is where you meet the safe-deposit process that needs a signature from someone who left, the passphrase that was rotated without re-wrapping the backup, the second key share nobody can locate. It is also where the hours go when the recovery is real, and after Coldcard nobody should need reminding that the clock is set by the attacker.
The other place findings come from is the operator. The drill is worth most when run by the second-most qualified person. If only one person can recover your assets, the drill’s first finding has already been made, and it is the most expensive one on the list.
What the drill measures
Verification is the easy part. The useful part is reconciliation. The backup’s metadata lists keysets and the account ranges they cover, and the live workspace has its own count. The difference is key material that exists and is not backed up. A backup taken before the last keyset was created verifies perfectly and covers none of the assets in that keyset. Then the addresses: export the list from the console, let the tool re-derive every one from the recovered keys, and count the ones that did not match. In the Fireblocks tool a mismatch is logged and dropped rather than shown, so the count lives somewhere other than the screen. Then the long tail, on paper: every staked, locked, or contract-held position, its exit path, its unbonding timeline, and its value, because none of it can be swept.
The record that comes out is eight lines long. I have not yet seen a drill report from the field with more than three of them.
In practice, organisations sit on a four-rung ladder. A backup exists, because someone downloaded it once. The backup has been verified, once, as point-in-time proof it decrypts and matches. Verification is scheduled and evidenced, so recoverability is a monitored property. Recovery is rehearsed, with people, environment, runbooks and the long tail proven under drill conditions.
Most institutions holding digital assets are on rung one and believe they are on rung four. The distance between those rungs is invisible right up until the day it is the only thing that matters.