Fireblocks Responds to Sha1-Hulud 2.0 Security Threat

Fireblocks, a leading digital asset management platform, has addressed a significant security threat from a self-replicating npm worm known as Sha1-Hulud 2.0, according to Fireblocks. This advanced version of the original Sha1-Hulud worm has compromised numerous npm packages, impacting various organizations within the technology sector since late November 2025.

Security Breach Investigation

On discovering suspicious activity within their non-production systems, Fireblocks promptly initiated an investigation. The investigation revealed unauthorized access to certain Zendesk support ticket data. Importantly, no customer funds were compromised, and the platform remains functional and secure.

Immediate Response and Measures

In response to the breach, Fireblocks implemented several containment measures. These included credential and key rotation, termination of unauthorized access, and enhanced security hardening across their infrastructure. The company is working with leading forensics experts and has also notified law enforcement to further investigate the matter.

Customer Communication and Recommendations

Fireblocks has proactively reached out to affected customers, advising them to remain vigilant for any suspicious communications or unusual activity that might exploit information from the incident. The company has also provided a detailed help center article outlining the incident and recommended actions for customers.

Webinar and Further Information

To enhance transparency and provide more details about the incident, Fireblocks will host a webinar on December 11, 2025, at 10:00 am ET. This session aims to provide further insights and answer any customer queries regarding the security breach.

Security remains a top priority for Fireblocks, and the company emphasizes its commitment to maintaining customer trust and confidence in its services.

Image source: Shutterstock