Crypto News
CERT/CC’s Oct. 26 advisory describes a hardened-derivation flaw in Fireblocks’ mpc-lib, tracked as CVE-2026-90975. A compromised descendant signer share, together with its chain code, can expose that party’s ancestor shares. The flaw does not independently recover a full spendable key; MPC threshold requirements remain relevant.
Why it matters
The issue concerns how signer shares are derived and protected within a multi-party computation setup. Exposure of ancestor shares can weaken the security assumptions around the affected party’s key material, even though the advisory’s described condition is not sufficient on its own to reconstruct a spendable key.
Market impact
For crypto custody providers and institutions, the disclosure puts attention on hardened derivation implementations and controls around signer shares and chain codes. The seed provides no information on affected deployments, remediation steps, or exploitation, so the practical scope cannot be determined from the advisory summary alone.
Frequently asked questions
-
What does CVE-2026-90975 affect?
The advisory describes a hardened-derivation flaw in Fireblocks’ mpc-lib.
-
What information is needed to expose ancestor shares?
The described condition combines a compromised descendant signer share with its chain code.
-
Does the flaw recover a full spendable key on its own?
No. The advisory summary says the flaw does not independently recover a full spendable key.
-
Why do MPC threshold requirements still matter?
The flaw exposes ancestor shares for the affected party, but does not by itself reconstruct a full spendable key. MPC threshold requirements remain relevant.
-
What custody security issues does the disclosure raise?
It focuses attention on hardened derivation and the protection of signer shares and chain-code material.
WuBlockchain
CryptoSlate
CoinTelegraph
WatcherGuru
CoinDesk