Crypto Apps May Still Trust Eight Blocked eMudhra Certificates

Crypto trading bots and exchange apps may still accept compromised eMudhra certificates even after browser makers blocked eight of them, leaving some users exposed when apps use separate security systems.

Google, Apple and Microsoft have blocked eight certificates issued by eMudhra, an Indian digital certificate authority. CertiK warned that browser protections may not reach software relying on its own certificate checks instead of browser trust settings.

Peiyu Wang, CertiK's senior director of digital asset security, said attackers could use compromised certificates to imitate an exchange, wallet interface or application programming interface (API). That could let them replace a deposit address or prompt a user to approve a malicious transaction.

Wang said an attack would still require someone to intercept or redirect network traffic; the certificate authority key alone would not expose wallet private keys. Crypto service operators should update their software and certificate trust stores, then check that their apps reject the affected certificates.