Fireblocks Updates Products After Eight eMudhra Certificates Are Compromised

Fireblocks has issued product updates for custody clients after warning that eight intermediate certificate authority (CA) certificates from eMudhra had compromised private keys. Some software may continue to trust the certificates even though browsers block them, because not all systems check updated revocation data.

The compromised group included six TLS certificates and two code-signing certificates. Fireblocks advised users of Fireblocks Agent for Key Link to install version 2.4.4. Customers using the legacy Python SDK should install version 2.19.1 or move to the current Python SDK. A Co-Signer image dated Oct. 21, 2026, no longer contains the affected certificates. Users relying on public key authentication should install the latest Co-Signer image.

For customer-run software, Fireblocks recommended refreshing operating system and language-runtime certificate bundles, then rebuilding, redeploying and restarting long-running services. It listed Python certifi version 2026.10.19 or later and Go versions 1.27.3 and 1.26.10 as examples. Fireblocks said its review found no use of the certificates on its platform after its changes, with no effect on customer assets, communications or funds. The alert concerns software certificate trust settings, which can differ from browser protections.