CertiK stated that cryptocurrency trading bots and exchange applications might remain at risk from eMudhra certificate vulnerabilities, despite emergency measures by major tech companies. By Tuesday, Google, Apple, and Microsoft had blocked eight vulnerable certificates issued by India's eMudhra; however, these measures may not protect crypto applications using separate security systems.
CertiK's Senior Director of Digital Asset Security, Peiyu Wang, told Cointelegraph: "Major browser blocks significantly reduce the risk for clients who receive and apply them. But some applications outside the browser ecosystem do not apply Certificate Transparency and do not receive the same revocation protections." Wang emphasized that crypto services are no more susceptible to this vulnerability than other industries, but attackers could use compromised certificates to impersonate HTTPS connections of exchanges, wallet interfaces, and APIs. Specifically, they could mimic crypto services, replace deposit addresses, or entice users to approve malicious transactions.
Such attacks require intercepting or redirecting a user's internet traffic. The compromised certificate authority keys themselves do not reveal wallet private keys. Wang urged crypto service operators to update their software and trusted certificate stores, and to ensure their applications reject the affected certificates.
This material is prepared solely for informational purposes and does not constitute financial advice or a recommendation.
Related articles
