Fireblocks mpc-lib flaw breaks key isolation
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
A fail-open bug in Fireblocks' mpc-lib hardened derivation lets attackers recover ancestor key shares from a compromised descendant share, with no vendor fix yet.
CERT/CC published VU#701544 describing CVE-2026-90975, a cryptographic fail-open vulnerability in Fireblocks' mpc-lib library, which underpins MPC-based custody of cryptocurrency private keys for institutions and exchanges. The flaw lies in the BIP32 hardened derivation implementation: when a parent private key is missing, the code substitutes a null buffer instead of rejecting the operation. Since the buffer becomes a known constant, the derivation delta becomes publicly computable, violating the ancestor isolation property that hardened derivation is supposed to guarantee.
The practical impact is that an attacker who compromises a single MPC party's lower-level (descendant) signer share, and who also knows the associated chain code, can compute the derivation delta and subtract it to recover that party's higher-level ancestor share, repeating the process up the hierarchy to obtain that party's root share. This does not by itself yield a spendable private key, since the MPC secret-sharing layer still requires a threshold of parties to reconstruct a key. However, it silently removes a defense-in-depth layer: compromise of one share can cascade across a party's entire derivation hierarchy over time with no logging or error indication. The precondition is trivially met in deployments that treat the chain code as public, as is common in BIP32 usage (e.g., exposed via watch-only extended public keys).
At time of publication, Fireblocks could not be reached by CERT/CC to coordinate disclosure, and no vendor patch is available. CERT/CC recommends integrators treat chain codes as secret rather than public, avoiding their exposure in watch-only extended public keys or to untrusted parties, which prevents the delta from being publicly computable. Additionally, organizations should not rely on hardened derivation alone for isolation between signer shares and should audit derivation paths for hardened segments, treating any single share compromise as a potential exposure path to that party's other shares. A complete fix requires a library code change. No in-the-wild exploitation has been reported; this is a disclosed cryptographic design flaw rather than an active campaign.
Mentioned in this report
Source reporting: https://kb.cert.org/vuls/id/701544
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 14,256 reports from 143 sources, 599 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs