CertiK Warns Browser Blocks May Leave Crypto Apps Exposed

Browser-level blocks may not protect crypto trading bots and exchange apps from misuse of eMudhra certificates, leaving them open to impersonation if their own safeguards lag, CertiK warned.

Google, Apple and Microsoft had blocked eight affected certificates by Tuesday. Those blocks help when a user's software receives and applies them; apps outside browser security controls may not get the same certificate-revocation safeguards.

Peiyu Wang, CertiK's senior director of digital assets security, warned that an attacker would need to intercept or redirect a user's internet traffic to impersonate an exchange, wallet interface or API over HTTPS. A successful impersonation could let an attacker change a deposit address or trick someone into approving a malicious transaction. A compromised certificate authority key alone would not reveal wallet private keys.

Wang said crypto services are not inherently more vulnerable to the flaw than businesses in other sectors. Peiyu Wang urged crypto operators to update their software and certificate trust stores, then confirm their applications reject the affected certificates.