Recovering After You Lose Your Device: You Get Your Identity Back, Not Your Balance

Guardian recovery restores who you are. It does not restore what you held. That sentence is the whole page, and almost nobody expects it, so the next section is the evidence rather than the reassurance.

What recovery actually does

Your identifier is an anchor that, by design, never holds or moves value. The recovery operation rebinds that anchor to a new key.

The code states the reason in its own comments: the identifier is a value-free anchor, the recovery operation is fee-exempt precisely because of that, and a rule in the system forbids funding it at all.

The recovery module contains no transfer, no sweep and no balance operation of any kind. CONTROL that makes the absence meaningful: transfer paths do exist elsewhere in the same backend, across eight files, so the search finds them when they are there. They are not here.

So if the phrase is gone, the value account derived from that phrase is gone with it, exactly as it would be in any wallet built on a recovery phrase. Guardians recover your identity, not your funds.

Why the design is that way, and what it costs

Separating the two is what makes recovery possible at all. A value key that guardians could rebind would be a value key guardians could steal, and a threshold of people who can move your money is a different and much more dangerous product.

The cost is the obvious one. People will lose funds and be surprised, because "social recovery" sounds like it covers everything. Any wallet offering this owes its users the distinction in plain words before they need it, and most do not give it.

Ours does, on the screen where you set the policy, and the sentence is worth quoting because it is the standard the rest of the interface should meet: recovery restores your identity, and your token balance still lives with your recovery phrase, so keep your phrase backed up separately. The overview card elsewhere in the same section carries no such qualifier, which is the inconsistency to fix rather than a missing disclosure.

The steps, when you do need it

Start recovery on a new device. You need your identifier, which is public, and not your phrase, which is gone.

A new phrase and key are generated on that device. Locally. The backend receives only the new public key and never the private one, which keeps the same property the rest of the wallet has: keys are never sent anywhere.

Your guardians approve. Each approval is theirs to give; the request records how many are needed and how many have arrived.

The threshold is met and the identifier is rebound. The device that started the recovery now holds the new key, and the new phrase is yours to write down as carefully as the first one.

What you should do before any of this is needed

Write down what your identifier is, somewhere separate from your phrase. Recovery starts with the identifier, and losing both means there is nothing to recover to.

Make sure your guardians can find the approval step. They will be doing it once, under pressure, possibly years after agreeing.

And accept, now rather than later, that the balance is not covered. If it matters to you, the answer is the phrase on paper, in more than one place, not the guardian list.

This has never been done for real

No guardian has completed a recovery on this wallet for anybody. The chain enforces the policy, the operations exist and the flow is written. The human half is untested, and untested recovery is a belief rather than a capability.