Crypto bots remain exposed to eMudhra flaw despite Big Tech fixes

eMudhra flaw — Cryptocurrency trading bots and exchange applications may still be vulnerable to a critical certificate security flaw, despite emergency patches rolled out by major tech companies, blockchain security firm CertiK has warned.

Senior director of digital assets security Peiyu Wang told Cointelegraph that while Google, Apple, and Microsoft have blocked eight vulnerable certificates issued by India’s eMudhra, the fixes are primarily for browsers. Many crypto applications operate outside that ecosystem and may not enforce the same revocation protections or Certificate Transparency, leaving them exposed.

Wang explained that attackers could exploit the compromised certificates to impersonate the HTTPS connections used by exchanges, wallet interfaces, and APIs. This could allow them to replace deposit addresses or trick users into approving malicious transactions, though it would require intercepting or redirecting a user’s internet traffic.

The security expert emphasized that crypto services are not uniquely susceptible, but the potential impact is high. He urged crypto operators to update their software and certificate trust stores immediately to ensure their applications reject the affected certificates.