Fireblocks explained: MPC custody, the Fireblocks Network, its customers and its risks

What is Fireblocks? It is a private software company that stores, moves and issues digital assets for institutions: banks, exchanges, payment firms and fintechs. It sells nothing to individual savers and has no token. Its core technology splits every private key into shares held in separate places, so that no single server, phone or employee ever holds a whole key. On 2 June 2026 the company said it had secured more than $16 trillion of digital asset transactions on over 200 blockchains, a figure of its own that no outside party has checked.

The name reached the general press on 22 October 2026. Axios reported, citing several unnamed sources, that Visa was in late-stage talks to buy Fireblocks for about $2.5 billion. A Fireblocks spokesperson answered: “This is news to us, and not true at present time.” Visa declined to comment. Our news report on the Axios story and the denial has the details; the last section of this page sets the reported figure against what the company was worth on paper in 2022.

What is Fireblocks: key custody software for institutions

Fireblocks was founded in 2018 by Michael Shaulov, its chief executive, Pavel Berengoltz and Idan Ofrat. The current team page lists Berengoltz as chief technology officer and Ofrat as chief product officer. The titles were different in 2019, when the Israeli business daily Globes named Ofrat as CTO and Berengoltz as head of research and development.

The company works from New York, where its trust subsidiary is registered at 5 Pennsylvania Plaza, and has a large engineering team in Israel. It does not publish a headcount. It cut 30 jobs, about 5% of staff, in February 2023, according to Calcalist. A second round in February 2024 removed 21 people, about 3% of the workforce, Blockworks reported, as the company reorganised its sales and customer support teams.

Fireblocks calls its product “an all-in-one platform to store, transfer, and issue digital assets”. In practice, the customer is always a company. A bank that wants to hold bitcoin for its clients, an exchange that shuffles funds between hot and cold storage, a payment firm that settles in stablecoins: each builds on the Fireblocks software but keeps its own customers, its own licence and, in most cases, the legal responsibility for the assets.

For a private person, Fireblocks is mostly invisible. An app you use may run on it without saying so. There is nothing to buy either: no token, no airdrop, no shares listed on a stock exchange, and no stock market listing has been announced. If the question is how to hold your own coins, the answer is a personal wallet, which our guide to crypto wallets explains, along with what holding your own keys means in practice.

How Fireblocks MPC works: key shares, secure hardware and a policy engine

Every crypto wallet is controlled by a private key. Whoever holds the key can sign transactions, and a signed transaction cannot be reversed. Institutions have long had two classic answers. One is to lock the key in a hardware security module in a data centre. The other is multisig, where the blockchain itself demands several signatures before funds move.

Fireblocks uses a third method, multi-party computation, or MPC. The key is never put together in one place, not even when it signs. Several key shares, kept in different environments, each run part of a calculation, and together they produce a valid signature. The blockchain sees an ordinary transaction. On its security page, the company promises: “No single point of private key compromise with key shares distributed across environments.”

The protocols are its own: MPC-CMP and a later version, MPC-CMPGG. On 6 August 2023 Fireblocks put the code of its MPC library on GitHub under a limited licence, and it pays outside researchers for bugs found in that library through a bounty programme on HackerOne. The rest of the platform is closed source.

Two more layers sit around the key shares. Signing and approvals run inside trusted execution environments, the sealed areas of a processor also called secure enclaves, and sensitive approvals on a phone require Face ID plus a PIN, the company says. Above that sits the Policy Engine, a set of rules each customer writes: who can send how much, to which addresses, and how many people must approve.

The Policy Engine blocks a transfer that breaks a rule. It also lets through any transfer that follows the rules, whoever triggered it. That distinction matters in the incidents described further down.

Then comes the Fireblocks Network, which links institutions on the platform so that a trading firm and an exchange, for example, can move assets to each other without copying deposit addresses by hand. Off Exchange builds on it: a trading firm keeps its collateral in an MPC wallet it shares with the exchange instead of depositing it there, which limits what it loses if the exchange fails. HTX first announced an Off Exchange link in July 2024 and said in a sponsored release in April 2025 that the integration was complete.

Fireblocks products in 2026: wallets, payments, tokenization and accounting

The Fireblocks homepage, read on 22 October 2026, lists about twenty products. The wallet side covers treasury management, wallet-as-a-service, embedded wallets, wallet connectors, qualified custody, cold wallets and business accounts. Security tools include the Policy Engine, Security Posture Management and a DeFi security suite. There are financial applications (tokenization, Earn, staking and Off Exchange) and compliance and data products, among them COR Compliance and Financial Data.

Payments: the Network for Payments and Flow

On 4 September 2025 the company launched the Fireblocks Network for Payments, aimed at firms that move money with stablecoins. At launch it counted more than 40 providers across more than 100 countries and over 60 currencies, and said 300 payment companies were already moving money over it. The same post gave two monthly volumes: “$300 billion in monthly payment flows” in one passage, “over $200 billion in stablecoin payments each month” in another. Fireblocks has not explained the gap.

The launch post itself named the first providers, among them Circle, the USDC issuer, Bridge, B2C2, Sygnum, Yellow Card, Zerohash and Zodia Markets. Links to the Circle Payments Network and to WalletConnect were described at the time as future integrations, according to Fintech News Singapore. Fireblocks’ network directory now lists support for both, without saying when it went live.

Flow followed on 2 June 2026, launched at Money20/20 Europe in Amsterdam according to the company’s press release. It lets payment providers and fintechs accept stablecoins inside their existing checkout, with more than 800 wallets supported across EVM chains, Solana and Bitcoin, and Coinbase, Kraken and Crypto.com accounts as payment sources. Funds land in a Fireblocks vault, a Dynamic embedded wallet or an address the merchant picks, and the release says Fireblocks takes custody at no point, conversion included.

Flutterwave, the African payments company, was named among the launch customers; Blipply was already using Flow in production, and Nuvion appeared as a partner. “Stablecoin payments are becoming as ubiquitous as credit cards,” the announcement said, a sales line rather than a measured fact.

Tokenization: Banking Circle’s EURI and the Qivalis euro token

Tokenization came in through an acquisition. On 29 September 2023 Fireblocks announced it had bought BlockFold, a smart-contract firm that had worked on tokenized deposits, stablecoins and central bank digital currency projects for financial institutions. Its co-founder Terence Siganakis became head of tokenization products. No price was given. The best-documented use is Banking Circle, the payments bank behind the EURI euro stablecoin: a Fireblocks customer story dated 22 October 2025 says Banking Circle imports its smart contracts into the Tokenization Engine and mints and burns EURI through it, with the keys under MPC.

In April 2026 Qivalis, an Amsterdam company set up by European banks to issue a euro stablecoin, chose Fireblocks as its “core infrastructure partner”. FOW, which reported the choice on 22 April, counted twelve banks in the consortium at the time. The group has grown since: on 14 October 2026 Qivalis said 37 banks in 15 countries back it, in the release that announced its e-money licence from De Nederlandsche Bank. That release did not mention Fireblocks, and the euro token still has no launch date. The licence belongs to Qivalis, not to its technology supplier.

Dynamic and TRES: wallets for apps, books for finance teams

Two recent purchases filled gaps at both ends. On 23 October 2025 Fireblocks bought Dynamic, a wallet and login provider for consumer apps founded in 2022, whose users included Kraken, Stripe and Zerohash, with Magic Eden and Ondo among the apps it served, according to The Block. About 30 Dynamic employees joined. No price was announced; a Dynamic representative told The Block the unofficial total was about $90 million. Shaulov said the deal gave Fireblocks “the complete stack for onchain finance, from custody to consumer”.

On 7 January 2026 Fireblocks agreed to buy TRES Finance, an onchain accounting company founded in 2022 with more than 230 clients, the wallet Phantom and the analytics firm Dune among them. Fortune put the deal at about $130 million in cash and shares, The Block reported; Fireblocks did not give a price. Five months later the Flow launch post credited TRES with its accounting and audit-ready records.

Who uses Fireblocks: four customers named, many more logos

In its June 2026 announcement, Fireblocks named Worldpay, BNY, Galaxy and Revolut as customers. Its homepage shows many more logos, among them ABN AMRO, Banking Circle, Checkout.com, eToro, MoneyGram, MoonPay, Western Union, Wintermute and WisdomTree. A logo on a vendor homepage is not proof of a current contract, and the page does not say what each company uses.

Visa’s logo is on that homepage too. The page does not say whether Visa is a customer, a partner or something else, and neither company has said.

BNY is both a customer and a shareholder. Fireblocks announced the bank’s investment on 18 March 2021, and BNY Mellon also took part in the 2022 Series E. Galaxy Digital, another named customer, invested in the 2020 Series B.

The only detailed figures on the customer base date from January 2022. The Block reported then that customers had grown from 150 to more than 800 in a year, that $45 billion sat in custody on the platform, that more than $2 trillion had been transferred, that revenue had risen by more than 600%, and that the company was not yet profitable. In 2026 Fireblocks speaks of “thousands of organizations” without an exact count, and it publishes no revenue.

Fireblocks valuation and funding: over $1 billion raised, $8 billion in 2022

Fireblocks has raised more than $1 billion from venture funds and banks, according to The Block, and its last priced round valued it at $8 billion in January 2022. No later round has been reported.

Round	Date	Amount	Leads and named investors	Valuation
Seed	Announced 11 June 2019	$4 million	Led by Gili Raanan of Cyberstarts	Not disclosed
Series A	Announced 11 June 2019	$12 million	Led by Tenaya Capital, with Cyberstarts; Eight Roads, Swisscom and MState also named	Not disclosed
Series B	November 2020	$30 million	Led by Paradigm, with Galaxy Digital, Digital Currency Group and earlier backers	Not disclosed
Series C	18 March 2021	$133 million	Coatue, Ribbit and Stripes as co-leads; BNY Mellon and Silicon Valley Bank as strategic investors	Not disclosed
Series D	27 July 2021	$310 million	Sequoia Capital, Coatue, Stripes, Spark Capital, DRW VC and SCB 10X as co-leads	About $2 billion at the time; $2.2 billion per later reports
Series E	27 January 2022	$550 million	Co-led by D1 Capital Partners and Spark Capital; General Atlantic, CapitalG and Altimeter among new investors	$8 billion

Sources differ on the earliest money. Globes reported on 11 June 2019 a $4 million seed round and a $12 million Series A, $16 million in all; Eight Roads and Global Venturing described the whole $16 million as a Series A. The Series C was announced four months after the Series B and brought the total to $179 million, according to Calcalist, which gave no valuation. Then the numbers jumped. The Series D in July 2021 put Fireblocks at about $2 billion, and six months later the Series E valued it at $8 billion, close to the peak of the 2021 crypto market.

The money paid for growth and for four acquisitions. The first was First Digital Assets Group, an Israeli crypto payments processor, on 16 February 2022, for cash and shares on undisclosed terms. First DAG had raised about $21 million and was building stablecoin acceptance for merchants, The Block reported. BlockFold followed in 2023, Dynamic in October 2025 and TRES in January 2026.

Licences: a New York trust charter, nothing on the ESMA MiCA register

Fireblocks’ list of regulated entities describes two American companies. Fireblocks Trust Company, LLC holds a limited purpose trust charter from the New York State Department of Financial Services, received in August 2024. It offers qualified custody to investment advisers, asset managers, ETF issuers and banks, and says it meets New York banking law and the SEC custody rule, a claim no regulator has publicly confirmed. Staking for its clients goes through Figment and Kiln.

The second entity, Fireblocks LLC, is registered with FinCEN as a money services business and holds money transmitter licences in 37 US states and the District of Columbia, each listed with its number. For eight more, California, Colorado and Massachusetts among them, the page says the state does not regulate the service or has issued a no-action letter. Alaska, Hawaii, New York, Virginia and Wisconsin do not appear in the table. In Tennessee, the licence does not cover virtual currency transmission.

Fireblocks was not on the ESMA register as of 22 October 2026. Coindaro searched the interim MiCA register of crypto-asset service providers that ESMA publishes (387 entries, file updated that day) and found no Fireblocks entity; the company’s own list of regulated entities names no EU or UK licence either. For most customers Fireblocks is a technology supplier, so the licence sits with the customer: an exchange, a bank such as Banking Circle, or a stablecoin issuer such as Qivalis.

Certifications came earlier. Ernst & Young completed a SOC 2 Type II examination of Fireblocks, announced on 19 December 2019, covering security, availability, processing integrity, confidentiality and privacy, with an unqualified opinion. On 2 June 2022 the company announced ISO 27001, 27017 and 27018 certification and mentioned an external audit without naming the firm. Its security page now claims a SOC 2 Type 2 certification with “zero material findings”, calls the company the first with C4 CCSS QSP Level 3 certification and describes its cryptographic libraries as “NCC-audited”. It gives no date or scope for any of these, and Coindaro found no published NCC report.

Fireblocks security record: research, client incidents and a lawsuit

In the reports Coindaro found, no theft of funds from the Fireblocks platform itself has been recorded. The company’s name has come up in four other kinds of events, and in each one the facts below are attributed to the party that stated them.

BitForge and the BitGo flaw

On 9 August 2023 Fireblocks’ cryptography research team disclosed BitForge, a set of zero-day flaws in widely used MPC protocols (GG-18, GG-20 and implementations of Lindell 17), presented at Black Hat USA and DEF CON after a 90-day disclosure period. The release said Coinbase Wallet-as-a-Service and Zengo had fixed their code and named Binance as affected. Fireblocks stated: “The MPC-CMP and MPC-CMPGG protocols implemented by Fireblocks are not affected by the BitForge vulnerabilities.”

Zengo’s chief technology officer, Tal Be’ery, said the issue was fixed promptly and no user funds were affected. Changpeng Zhao, then Binance’s chief executive, said the flaw sat in the TSS library Binance had open-sourced, that it had been fixed and that no Binance user funds were affected, according to Cointelegraph.

Earlier, in March 2023, Fireblocks published details of a flaw it had found in the threshold signature scheme of BitGo, a direct competitor. BitGo had halted wallet operations when the exploit was found in December 2022, deployed fixes in February 2023 and asked clients to update by 17 March, according to ForkLog, which reported no losses. Ofrat, then Fireblocks’ chief technology officer, put it bluntly: “The vulnerability is the result of the wallet provider not adhering to proven cryptographic standards.”

Fortress Trust, September 2023

Fortress Trust, a US custodian that used Fireblocks, notified the company of an incident on 28 August 2023. In its statement of 12 September 2023, Fireblocks quoted Fortress as saying “a third-party provider was internally breached”, and said its platform “behaved according to the configuration and rules as intended by Fortress”. By its account the breach sat in a third-party service that had a preconfigured automated authorisation, and transactions were blocked once a preset limit was reached. It added that no other Fireblocks customer was affected. The statement gives no amount lost.

Support data, December 2025

In December 2025, while the Sha1-Hulud 2.0 worm was spreading through npm software packages, Fireblocks found unauthorized access to some of its Zendesk support ticket data, according to Blockchain.News, which reported the company’s statement on 10 December. The company said no customer funds were compromised, rotated credentials, hired forensic experts and informed law enforcement.

The StakeHound lawsuit

In June 2021 StakeHound, a staking company, sued Fireblocks in the Tel Aviv District Court. It claimed that negligence had led to the loss of the keys to 38,178 ETH, then worth about $75 million. Fireblocks answered that it “was never in charge of the keys”. In its version, StakeHound generated its own BLS key shares in a one-off job handled outside the Fireblocks platform; Fireblocks agreed to store them temporarily, outside its standard backup process because it did not support BLS, and that storage later failed. It also said StakeHound had been urged repeatedly to keep backups with a third-party provider and had not done so. Coindaro found no report of a ruling or a settlement.

Fireblocks competitors: BitGo, Anchorage, Copper, Coinbase and the banks

The closest rival is BitGo, which listed on the New York Stock Exchange under the ticker BTGO. It priced its shares at $18 on 21 January 2026, above the marketed range, raised about $212.8 million and began trading the next day at a valuation of over $2 billion, according to The Block. Anchorage Digital, Copper and Coinbase’s institutional custody business compete for parts of the same work.

Banks are moving in as well. Standard Chartered signed a deal on 21 October 2026 to buy all of Zodia Custody, as we reported, though price and closing date remain undisclosed. When Fireblocks won its New York charter in August 2024, Cointelegraph noted that the state regulator’s list of trust companies also included Coinbase Custody Trust, Fidelity Digital Asset Services and PayPal’s digital asset unit.

The difference is in the model. Qualified custodians such as Anchorage or Coinbase hold assets for clients under their own licences. Fireblocks mostly sells the tools for others to do it, and added a trust company in 2024 for clients that need a regulated custodian.

Fireblocks risks: no public accounts, one vendor for thousands of clients

Fireblocks is private and publishes no audited accounts. Revenue and profit for 2026 are unknown; the last public statement on profit, in January 2022, said it was not profitable. Its headline numbers are its own claims and they move: $2 trillion transferred in January 2022, “$16 trillion” secured in June 2026, two different monthly payment volumes in one 2025 announcement.

Concentration is the structural risk. Thousands of institutions, by the company’s count, depend on one vendor for key management and signing. A serious flaw or a long outage would hit many of them at once, and the December 2025 support-data case shows that third-party tools around the platform are part of the attack surface.

The Policy Engine protects keys and rules, not decisions. The Fortress Trust case, as Fireblocks described it, shows that an authorised third party acting within the customer’s own configuration can still move funds.

Regulation is uneven: a New York charter and US state licences, but nothing on the ESMA MiCA register, while the SEC works on new custody rules in the United States. Four acquisitions in under four years also have to be absorbed into one product line.

The Visa report of 22 October 2026: what is known

Axios Pro reported on 22 October 2026 that Visa was in late-stage talks to buy Fireblocks for about $2.5 billion. The report sits behind a paywall; CoinDesk, The Block and Cointelegraph relayed it. Fireblocks called it “news to us” and “not true at present time”. Visa declined to comment: “We don’t comment on rumors or speculation,” a spokesperson told The Block.

CoinDesk added that talk of a sale had circulated for three or four weeks and that, according to its anonymous sources, Coinbase was also seen as a possible buyer. Coinbase denied any involvement after the article came out.

If a deal happened at that price, it would be about 69% below the $8 billion of January 2022, by our calculation. A sale price and a venture valuation are not the same measure, and BitGo was valued at over $2 billion when it listed in January 2026. For now nothing is confirmed. The next fact to watch is a statement from Visa or Fireblocks, which we will add to our news report.