Recovery

Your 24 words are your everything

The recovery seed works exactly like a cryptocurrency wallet seed — same BIP-39 standard, same mechanism, same responsibility. Millions of people manage one to protect cryptocurrency: if you can secure a Bitcoin wallet, you can secure Crypt-in.

Write it on paper. By hand. Two copies, in two separate locations. Never digital. Never photographed.

After recovery with your seed:

• K_identity is restored
• your PIN is recalculated automatically — same seed, same PIN, always
• no reconfiguration is needed
• all your .crin files are accessible again

One thing does not come back: K_attestation is generated from hardware entropy and is unique to the physical chip, so a recovered dongle presents a new attestation identity to the licence server. That is deliberate — it is what distinguishes the original dongle from a second one provisioned with the same seed.

The lake8.dev server is needed only to authorise the licence transfer to the new dongle, at most three times a year. That is an anti-abuse limit, not a cryptographic constraint: write to info@lake8.dev for exceptional cases.

That three-a-year limit is the replacement one — this page is about a dongle that broke or was lost, where the old chip stops counting. Provisioning a backup dongle that stays alive alongside the original is a different operation with its own limit: one per calendar year, resetting on 1 January. See Security model.

If you lose the seed and your dongle breaks, the data is gone permanently. That is not a bug — it is the guarantee that nobody else can reach it either. Not even lake8.dev.

Recovery procedure

1. Buy a new ESP32-S3 (~€5, any supplier)
2. Download firmware from cryptin.lake8.dev/download
3. Flash the firmware (see Flash Guide)
4. Connect via serial (UART0/CH343 port, 115200 baud)
5. Send command: recover
6. Enter your 24 BIP-39 words when prompted
7. K_identity is restored — all .crin files accessible again

License transfer

After recovery, the new chip has a different K_attestation.

Open Crypt-in app → Settings → Transfer License. The app contacts license.lake8.dev to transfer the entitlement from the old to the new K_attestation (max 3 times per year — the replacement limit, not the backup one).