Fireblocks has urged customers to update affected software following the compromise of eight intermediate certificate authority certificates associated with eMudhra, while separately launching a trading platform designed to simplify stablecoin liquidity sourcing for payment companies and financial institutions.
The digital asset infrastructure provider said its investigation had found no evidence of the compromised certificates being used on its platform after remedial measures were implemented. It reported no impact on customer assets, communications, or funds related to the security incident.
Eight Compromised Certificates Trigger Security Response
In an October 21, 2026, blog post, Fireblocks said six compromised certificates were associated with Transport Layer Security (TLS), while two were used for code signing. The compromised private keys could potentially allow attackers to create fraudulent HTTPS certificates or sign malicious software for applications that continued to trust the affected certificates.
Although browsers have blocked the certificates, applications and background services that do not adequately check certificate revocation information may remain vulnerable until their certificate trust stores are updated.
Fireblocks said it was not publicly known whether attackers had exploited the weakness against affected clients. The company described the incident as a certificate trust issue rather than a platform-wide security failure.
The company advised users of Fireblocks Agent for Key Link to upgrade to version 2.4.4 and customers using the legacy Python SDK to install version 2.19.1 or migrate to the current SDK. A new Co-Signer image dated October 21 no longer includes the affected certificates.
Customers were also advised to update operating system images, host systems, and certificate authority bundles used by programming language runtimes. Fireblocks cited Python certifi version 2026.10.19 or later and Go versions 1.27.3 or 1.26.10 as examples of updated packages.
The company said its secure enclaves relied on a preapproved list of certificate authorities that excluded eMudhra. It was also contacting third-party providers to confirm their upgrade status and reviewing its corporate environment for potential exposure.
Fireblocks Launches Liquidity Market for Stablecoins
Separately, Fireblocks has launched Liquidity Market, a platform that enables payment companies and other businesses to request, compare, and execute stablecoin trades using multiple over-the-counter (OTC) liquidity providers within a single trading environment.
The platform brings price discovery and trade execution into the Fireblocks environment, allowing customers to compare competing quotes while retaining their existing relationships, credit terms and settlement arrangements with individual trading desks.
The launch addresses a liquidity-sourcing process that has traditionally required businesses to contact trading desks individually through separate portals, email and messaging services. This approach can make price comparisons difficult, particularly when quotes expire quickly and treasury teams must reconcile credit limits, available balances and trading conditions manually.
Fireblocks said OTC and trading firms transferred nearly $50 billion in stablecoins to payment companies, fintech firms and financial institutions through its network over the preceding 12 months.
MoneyGram, OpenPayd, Reap, TapTapSend and Zepz participated as design partners. B2C2 and Zodia Markets were available as liquidity providers at launch, while Cumberland, FalconX, GSR, Hercle, Nonco and Wintermute were expected to join subsequently.
Centralized Trading Controls Without Custody
Liquidity Market consolidates credit information, margin requirements, and balances across connected trading desks. Customers can execute transactions through the Fireblocks Console or application programming interface, with individual executions recorded against their originating quotes.
The platform uses Fireblocks’ Policy Engine to enforce trading limits and execution permissions across connected providers. Account connections and order execution require quorum approval, adding a layer of governance to transactions conducted through the system.
Fireblocks said it does not charge a trading spread, take custody of assets during conversion, or participate in the flow of funds. Instead, customers settle transactions directly with their selected liquidity providers.
The service supports major stablecoins against the US dollar, euro, British pound and other Group of Ten currencies. Its availability does not guarantee that every provider or currency pair is accessible in every jurisdiction.
Ran Goldi, Fireblocks’ chief payments and network officer, said the platform was intended to bring pricing and execution into the same environment where many payment companies and their trading counterparties already manage their digital asset treasuries.
Security and Liquidity Remain Key Priorities
The two developments address different operational challenges facing digital asset businesses. The eMudhra incident highlights the importance of maintaining updated certificate trust configurations across customer-managed software, while Liquidity Market targets the fragmented process of sourcing stablecoins from multiple trading counterparties.
For payment companies expanding cross-border services, access to competitive liquidity can influence transaction costs and the ability to support additional payment corridors. The new platform aims to streamline that process while preserving direct settlement between customers and liquidity providers.
Fireblocks said additional liquidity providers would be added over time, while its security response would continue with software updates and checks involving third-party providers.
