CertiK Warns Crypto Bots Still Exposed to eMudhra Flaw — SkimNews
Get the Finance newsletter
Daily finance — markets, central banks, M&A, the prints that move money. Free.
- CertiK warned that crypto trading bots and exchange applications may remain exposed to the eMudhra certificate security flaw despite emergency fixes from major technology companies.
- Google, Apple, and Microsoft had blocked eight vulnerable certificates issued by India's eMudhra by Tuesday.
- CertiK senior director of digital assets security Peiyu Wang told Cointelegraph that browser blocks substantially reduce risk for clients that enforce them, but some applications outside the browser ecosystem don't enforce Certificate Transparency or receive the same revocation protections.
- Wang said attackers could exploit compromised certificates to impersonate HTTPS connections used by exchanges, wallet interfaces, and APIs — specifically replacing deposit addresses or tricking users into approving malicious transactions.
- Wang clarified that compromised certificate authority keys alone would not expose wallet private keys, and such attacks would also require intercepting or redirecting users' internet traffic.
- Wang urged crypto operators to update their software and certificate trust stores and verify that their applications reject the affected certificates.
Why it matters: Crypto exchanges, wallet operators, and trading bot developers running custom software outside browsers now face a protection gap that major tech fixes don't cover, requiring them to manually update certificate trust stores or risk deposit-address spoofing and malicious transaction approvals.
Ask SkimNews
