Export keys from DFNS

This guide walks through exporting a wallet’s private key out of DFNS and confirming it works. The ceremony is the same whichever goal you have:

Migrate to another provider — move a key to a different custody solution. See also importing keys for the reverse direction.
Disaster recovery backup — hold an independent, point-in-time copy so you can keep operating if DFNS is unavailable. See manual key backup for how this compares to Layer 4.

For how export works under the hood, see Key import and export. Export is not enabled by default — contact our to activate it for your organization.

The ceremony reconstitutes the full wallet private key — a single point of failure — on the machine that runs it. Run it on a trusted, isolated machine, and from the moment the key exists, treat it as break-glass: keep it offline, encrypt it at rest, restrict access, and securely erase every intermediate copy once you are done.

Export a key

The export ceremony needs connectivity to the DFNS API — it is the one unavoidable online step. Everything you do with the key afterwards should stay offline. Requirements:

Export activated for your organization (contact our ).
A service account or user with the Keys:Export permission, and its signing key pair. Export requires a user action signature, which the SDK produces with this key.
The keyId of the key to export (find it on the wallet in the dashboard or via List Wallets).
A trusted, isolated machine with Node.js and the export SDK example, which uses @dfns/sdk-keyexport-utils-nodejs.

Run the export ceremony

The SDK generates an ephemeral encryption key pair, calls Export Key, and reconstitutes the private key locally — DFNS never handles a plaintext key (details).

const ctx = newWalletExportContext()
const exported = await dfnsApi.keys.exportKey({ keyId: KEY_ID, body: ctx.getConf() })
const privateKey = ctx.recoverSecretKey(exported) // full wallet private key, in memory

See the export SDK example for the complete, runnable program.

Secure the recovered key

Disconnect the machine from the network. Move the key to encrypted, offline storage — cold storage, an HSM, or a hardware-encrypted medium — with tightly restricted access, then securely erase every plaintext copy from the ceremony machine.Exporting does not affect the wallet in DFNS: it keeps signing normally and is flagged as exported. Nothing changes on-chain, and no funds move until you sign with the exported key.

[Optional] Verify the exported key

Confirm the exported key controls the wallet by signing with it — the same operation you would perform to use the key elsewhere. Signing stays on the offline machine; only the signed transaction crosses to an online machine to broadcast, so the private key never goes online.

A recovered key is live and controls the same address on every chain. Test on a testnet (Sepolia) so no real assets move.

Requirements:

Offline machine holding the exported key.
Online machine to broadcast the signed transaction.
Removable media (e.g. an SD card or a USB drive) to move files between the two.
Foundry’s cast on both machines. Copy the binary to the offline machine from a verified download rather than installing over the network.

Collect transaction parameters (online)

On the online machine, note the values the offline signer needs: the address’s current nonce, a gas price, and the chain ID (Sepolia is 11155111). Fund the address with a little Sepolia test ETH from a public faucet — a zero-value transaction still needs gas. Carry these values to the offline machine.

Derive the address and sign (offline)

On the offline machine, take the exported key’s hex value for the secp256k1 curve (an Ethereum key) and prefix it with 0x.Derive the address and confirm it matches the one you funded:

cast wallet address --private-key 0x<private_key>

Build and sign the transaction offline. This prints a signed raw transaction hex and broadcasts nothing:

cast mktx <address> \
  --value 0 \
  --nonce <nonce> \
  --gas-limit 21000 \
  --gas-price <gas_price> \
  --chain 11155111 \
  --legacy \
  --private-key 0x<private_key>

Copy the signed raw transaction hex onto removable media. It contains no private key, so it is safe to move to an online machine.

Broadcast the signed transaction (online)

On the online machine, broadcast the signed transaction from Etherscan’s Broadcast Transaction page, or from any machine with an RPC endpoint:

cast publish <signed_raw_tx> --rpc-url https://rpc.sepolia.org

A returned transaction hash confirms the exported key signs correctly.

Introduction

Core Concepts

Platform Features

Networks

Solutions

Guides

Advanced

Export a key

[Optional] Verify the exported key

​Export a key

​[Optional] Verify the exported key

Export a key

[Optional] Verify the exported key