Cardano ZK Recovery Tool Completes Full Wallet Claim on Preview Testnet

A Cardano zero-knowledge recovery tool has completed a full claim on the Preview testnet, transferring assets from a custody contract after confirming that the claimant controlled the original master seed.

The open-source release includes the cryptographic circuit, local prover, Plutus V3 validator, formal verification work, test transactions and a prototype interface called ReclaimGlobal. It expands an earlier experiment disclosed by Charles Hoskinson into a publicly reviewable recovery flow with working on-chain results.

The repository gained additional attention after developer Phil highlighted its architecture, documentation and proving system. Hoskinson later reposted the assessment.

ReclaimGlobal Links Wallet Ownership to Rescued Assets

ReclaimGlobal is designed for incidents in which assets have already been removed from compromised credentials and placed inside a recovery contract.

An affected user connects the compromised wallet in read-only mode, generates an ownership proof locally and selects a fresh wallet to receive the assets. The recovery phrase remains on the user’s device and is not submitted to the contract, the recovery operator or an external server.

A separate locking flow allows an operator, rescuer or donor to deposit assets into an owner-bound Cardano UTxO. The funds can then be claimed only by a user able to prove that the affected payment credential was derived from the corresponding master seed.

The tool is not intended for users who have lost their recovery phrase. The claimant must still control the original seed, and the assets must first be secured inside the custody structure. Funds already transferred beyond that recovery process cannot be retrieved by the contract.

The repository describes an incident involving approximately 8,823 affected payment credentials. Its technical explanation states that recovery phrases, master seeds and chain codes were not exposed. Instead, derived signing keys were compromised through a deterministic nonce flaw in the transaction signer.

Because individual wallet credentials are derived from a master secret through one-way operations, a stolen derived key may allow unauthorized transaction signing without revealing the original seed. The recovery system uses that distinction to separate the legitimate wallet owner from an attacker holding only the compromised credential.

Plutus V3 Verifies Ownership Without Revealing the Seed

The ownership proof is generated locally through a Groth16 proving system operating over the BLS12-381 curve. The resulting proof is 336 bytes, while the underlying circuit contains approximately 3.45 million constraints.

Cardano’s Plutus V3 environment verifies the proof before the custody contract releases any assets. The claimant’s recovery phrase, private keys and complete derivation path are not published on-chain.

The new destination credential is cryptographically bound to the proof. An observer cannot copy the transaction and replace the receiving address because changing the destination invalidates the claim.

The validator also confirms that the requested payout matches the entitlement stored in the custody datum. Additional conditions prevent the contract from paying itself or returning the assets to the compromised credential.

Two initial milestones were completed on the Preview testnet. In the first, five test ADA were locked behind a verification gate and released after the node accepted a valid proof. A second transaction using the same proof with one byte modified was rejected.

The complete recovery flow was then tested through the full custody validator. Five test ADA were deposited, a proof was generated for a newly created destination wallet, and the contract verified ownership, entitlement and destination binding before releasing the assets.

A later claim added further protections, including a rule preventing payment back to the affected credential and a ticket-based mechanism for tracking spent claims. The transaction settled within Cardano’s execution limits.

The repository also includes Lean 4 proofs covering the validator’s decision logic, together with technical specifications, circuit code and several rounds of review. One formal connection remains open between the complete R1CS constraint system and the canonical witness relation, including the SHA-512 and Ed25519 components.

Mainnet Use Requires Additional Security and Governance Controls

ReclaimGlobal currently operates as a Preview testnet prototype, with several production safeguards still under development.

The verifying key used in the existing deployment was produced through a single-operator trusted setup. The repository states that this model is suitable for testnet development but not for a system responsible for real user assets.

Groth16 requires a structured setup process to create the proving and verifying keys. A participant retaining all secret setup material could theoretically manufacture invalid proofs that still pass verification.

The proposed production model therefore uses a multiparty ceremony in which independent contributors add their own randomness and destroy their individual secrets. The repository outlines a process involving public randomness, a published contribution transcript and independent verification of the completed ceremony.

Operational controls also remain unresolved. The documentation identifies the need to define who creates the eligibility list, how allocated amounts can be independently verified and how custody assets are protected while claims are processed.

Further work includes completing the on-chain spent-state and nullifier system, strengthening encoding protections, converting the prototype into a production CIP-30 application and commissioning a full external audit of the circuit, contract and setup ceremony.

The Preview transactions have established that Cardano can verify a multi-million-constraint ownership proof and complete the recovery payout inside a single transaction. Moving the system toward production now depends on removing single-operator trust and establishing transparent rules for custody, eligibility and claim authorization.