Blockchain security firm CertiK said crypto trading bots and exchange apps may still be exposed to risks tied to compromised certificates issued by Indian digital certificate authority eMudhra, even after Google, Apple and Microsoft blocked eight affected certificates. The firm said browser-level fixes may not extend to software that relies on separate security systems, leaving some applications outside the scope of those protections.
Peiyu Wang, senior director of digital asset security at CertiK, said attackers could use the compromised certificates to impersonate exchange interfaces, wallet front ends and APIs, potentially swapping deposit addresses or tricking users into approving malicious transactions. At the same time, Wang said such attacks would still require network traffic interception or redirection. CertiK added that the certificate authority key issue alone cannot expose wallet private keys.
The company urged crypto service operators to update software and certificate trust stores, and to verify that their applications reject the affected certificates, according to Cointelegraph.
Blockchain security firm CertiK said crypto trading bots and exchange applications may still face exposure to risks linked to compromised certificates issued by Indian digital certificate authority eMudhra, even though Google, Apple and Microsoft have already blocked eight affected certificates.
According to CertiK, browser fixes may not cover software that uses separate security systems, which means some crypto applications could remain vulnerable.
How the attack could work
Peiyu Wang, senior director of digital asset security at CertiK, said attackers could use the compromised certificates to impersonate exchange interfaces, wallet front ends and APIs. That could let them replace deposit addresses or trick users into approving malicious transactions.
Wang added that such attacks would still require intercepting or redirecting network traffic. The compromised certificate authority keys alone cannot expose wallet private keys.
What operators should do
CertiK said crypto service operators should update software and certificate trust stores, and confirm that their applications reject the affected certificates.
The report was cited by Cointelegraph.
This article was originally published by Bit.Fan. For more cryptocurrency news and market insights, visit www.bit.fan. Disclaimer:
The market information, project data, and third-party content displayed on this platform are for industry information sharing only and do not constitute any form of investment advice or return commitment.
Cryptocurrency trading carries high risks. Users should fully assess their risk tolerance and make independent decisions. All profits, losses, and legal responsibilities are borne by the users themselves.
