mpc-lib hardened derivation fails to protect ancestor isolation

Overview Fireblocks' mpc-lib library contains a cryptographic fail-open vulnerability in its BIP32 hardened derivation implementation in the case of a missing private parent key. This breaks the ancestor isolation property of hardened derivation, allowing an attacker with a compromised lower-leve...

PT-2026-125556

Name of the Vulnerable Software and Affected Versions mpc-lib affected versions not specified Description A cryptographic implementation flaw in the mpc-lib library used in the MPC-based custody pipeline breaks the security guarantee of BIP32 hardened derivation. The issue occurs because the...