Fireblocks is urging customers to update affected software after eight intermediate certificate authority certificates tied to eMudhra were compromised. In a separate move, the digital asset infrastructure provider has launched a trading platform designed to simplify stablecoin liquidity sourcing for payment companies and financial institutions.

The company said its investigation found no evidence the compromised certificates were used on its platform once remedial measures were in place, and it reported no impact on customer assets, communications, or funds related to the security incident.

Eight Compromised Certificates Trigger Security Response

In an October 21, 2026, blog post, Fireblocks said six of the compromised certificates were associated with Transport Layer Security (TLS), while two were used for code signing. The exposed private keys could potentially allow attackers to create fraudulent HTTPS certificates or sign malicious software for applications that continue to trust the affected certificates. As intermediate certificates, they sit below root authorities in the public key infrastructure hierarchy, which is why a single compromised issuer can carry consequences for every site and application chained to it.

Although browsers have blocked the certificates, applications and background services that do not adequately check certificate revocation information may remain vulnerable until their certificate trust stores are updated. Revocation status is typically distributed through certificate revocation lists and the Online Certificate Status Protocol, mechanisms that are implemented unevenly outside mainstream browsers.

Fireblocks said it was not publicly known whether attackers had exploited the weakness against affected clients. The company characterized the event as a certificate trust issue rather than a platform-wide security failure.

As remediation, Fireblocks advised users of Fireblocks Agent for Key Link to upgrade to version 2.4.4, and customers on the legacy Python SDK to install version 2.19.1 or migrate to the current SDK. A new Co-Signer image dated October 21 no longer includes the affected certificates.

Customers were also advised to update operating system images, host systems, and certificate authority bundles used by programming language runtimes. Fireblocks cited Python certifi version 2026.10.19 or later and Go versions 1.27.3 or 1.26.10 as examples of updated packages.

The company said its secure enclaves rely on a preapproved list of certificate authorities that excluded eMudhra. It is also contacting third-party providers to confirm their upgrade status and reviewing its corporate environment for potential exposure. The follow-up reflects how certificate trust extends through every software dependency a platform and its customers rely on, not just the systems they operate directly.

Fireblocks Launches Liquidity Market for Stablecoins

Separately, Fireblocks has launched Liquidity Market, a platform that enables payment companies and other businesses to request, compare, and execute stablecoin trades with multiple over-the-counter (OTC) liquidity providers within a single trading environment. Stablecoins are blockchain-based tokens designed to track the value of reference currencies, and businesses moving them in size often turn to OTC desks rather than public exchanges.

The service brings price discovery and trade execution into the Fireblocks environment, allowing customers to compare competing quotes while retaining their existing relationships, credit terms, and settlement arrangements with individual trading desks.

The launch addresses a liquidity-sourcing process that has traditionally required businesses to contact trading desks individually through separate portals, email, and messaging services. That approach can make price comparisons difficult, particularly when quotes expire quickly and treasury teams must manually reconcile credit limits, available balances, and trading conditions.

Fireblocks said OTC and trading firms transferred nearly $50 billion in stablecoins to payment companies, fintech firms, and financial institutions through its network over the preceding 12 months.

MoneyGram, OpenPayd, Reap, TapTapSend, and Zepz as design partners. B2C2 and Zodia Markets were available as liquidity providers at launch, while Cumberland, FalconX, GSR, Hercle, Nonco, and Wintermute were expected to join subsequently.

Centralized Trading Controls Without Custody

Liquidity Market consolidates credit information, margin requirements, and balances across connected trading desks. Customers can execute transactions through the Fireblocks Console or an application programming interface, with individual executions recorded against their originating quotes.

The platform uses Fireblocks' Policy Engine to enforce trading limits and execution permissions across connected providers. Account connections and order execution require quorum approval, adding a layer of governance to transactions conducted through the system.

Fireblocks said it does not charge a trading spread, take custody of assets during conversion, or participate in the flow of funds. Customers instead settle transactions directly with their selected liquidity providers.

The service supports major stablecoins against the US dollar, euro, British pound, and other Group of Ten currencies. Availability does not guarantee that every provider or currency pair is accessible in every jurisdiction.

Ran Goldi, Fireblocks' chief payments and network officer, said the platform was intended to bring pricing and execution into the same environment where many payment companies and their trading counterparties already manage their digital asset treasuries.

Security and Liquidity Key Priorities

The two developments address distinct operational challenges facing digital asset businesses. The eMudhra incident highlights the importance of keeping certificate trust configurations up to date across customer-managed software, while Liquidity Market targets the fragmented process of sourcing stablecoins from multiple trading counterparties.

For payment companies expanding cross-border services, access to competitive liquidity can influence transaction costs and the ability to support additional payment corridors. The new platform aims to streamline that process while preserving direct settlement between customers and liquidity providers.

Fireblocks said additional liquidity providers would be added over time, while its security response would continue with software updates and checks involving third-party providers.

Source: CoinTrust