Key facts
- Major tech companies have blocked eight vulnerable eMudhra certificates.
- Fixes may not protect crypto applications outside the browser ecosystem.
- Attackers could impersonate crypto services using compromised certificates.
- Crypto services are not inherently more susceptible to the flaw.
Major technology companies, including Google, Apple, and Microsoft, have taken steps to block eight vulnerable certificates issued by India's eMudhra. However, blockchain security firm CertiK warns that cryptocurrency trading bots and exchange applications may still be exposed to the flaw. According to CertiK's Peiyu Wang, while browser-based fixes significantly reduce risk for users who enforce them, applications operating outside the browser ecosystem might not implement the same Certificate Transparency or revocation protections. This could allow attackers to impersonate the secure HTTPS connections used by crypto exchanges, wallet interfaces, and APIs. Wang clarified that crypto services are not uniquely vulnerable but that compromised certificates could be exploited to trick users into approving malicious transactions or replacing deposit addresses, provided attackers can also intercept internet traffic. CertiK advises crypto operators to update their software and verify that their applications reject the affected certificates.