Crypto apps may remain exposed after eMudhra certificate fixes, CertiK warns

Traders Union
All News
Crypto
Crypto apps eMudhra certificate risk

Highlights

Google, Apple, and Microsoft have blocked eight vulnerable eMudhra certificates, but CertiK warns crypto apps outside browsers may remain at risk.
CertiK senior director Peiyu Wang says compromised certificates could let attackers impersonate exchanges and wallet interfaces, risking targeted fraud if traffic is intercepted.
CertiK urges crypto operators to update software and trust stores, noting operational risks for platforms relying on security systems outside major browser protections.

Certificate flaw risks beyond browsers

As reported by Cointelegraph, blockchain security company CertiK says emergency action by Google, Apple and Microsoft does not fully remove exposure for crypto applications that do not use the same browser-based certificate protections.

By Tuesday, the companies had blocked eight vulnerable certificates issued by eMudhra, according to CertiK senior director of digital assets security Peiyu Wang. He says major browser blocks substantially reduce risk for clients that receive and enforce them, but some applications outside the browser ecosystem do not enforce Certificate Transparency or benefit from the same revocation safeguards.

Wang says crypto services are not inherently more vulnerable than other sectors. Still, attackers could use compromised certificates to impersonate HTTPS connections used by exchanges, wallet interfaces and application programming interfaces, creating an opening for targeted fraud.

Potential impact on exchanges and bots

In crypto-specific scenarios, attackers could impersonate services, replace deposit addresses or trick users into approving malicious transactions, Wang says. He adds that such attacks would also require interception or redirection of internet traffic, and that compromised certificate authority keys alone would not expose wallet private keys.

CertiK is urging crypto operators to update software and certificate trust stores, and to confirm that their applications reject the affected certificates. The warning highlights an operational risk for platforms and trading infrastructure that depend on custom or slower-moving security systems outside the main browser ecosystem.

Our earlier article on Cohere’s planned acquisition of AI cybersecurity startup AISLE outlined how the deal would add vulnerability-detection capabilities to the company’s expanding enterprise security push in Europe. We also noted AISLE’s research track record, including the discovery of hundreds of new software bugs and multiple OpenSSL vulnerabilities later fixed — a reminder of how weaknesses in widely used security components can ripple across many services.

This material may contain third-party opinions, none of the data and information on this webpage constitutes investment advice according to our Disclaimer. While we adhere to strict Editorial Integrity, this post may contain references to products from our partners.