Cryptocurrency trading bots and exchange applications may remain exposed to a certificate security flaw tied to India's eMudhra, despite emergency fixes rolled out by major technology companies, according to blockchain security firm CertiK.

By Tuesday, tech giants including Google, Apple and Microsoft had blocked eight vulnerable certificates issued by eMudhra — certificates that could fake versions of legitimate websites, as Cointelegraph previously reported. Certificate authorities such as eMudhra sit at the foundation of HTTPS trust: they are trusted organizations that issue the digital certificates websites present to prove their identity, which is why improperly issued certificates are treated as a web-wide security concern. However, those browser-level fixes may not extend to crypto applications that rely on separate security systems, CertiK's senior director of digital assets security, Peiyu Wang, told Cointelegraph.

"Major browser blocks substantially reduce the risk for clients that receive and enforce them," Wang said. "Some applications outside the browser ecosystem do not enforce Certificate Transparency or receive the same revocation protections."

Certificate Transparency is a widely used framework under which browsers check website certificates against public, auditable logs, helping ensure that improperly issued certificates can be detected and blocked. Applications operating outside that ecosystem may not benefit from the same safeguards — a gap that reaches crypto directly, where trading bots and exchange applications typically interact with services through APIs rather than through a browser.

Wang stressed that crypto services are not inherently more susceptible to the flaw than other industries. Even so, attackers could exploit compromised certificates to impersonate the HTTPS connections used by exchanges, wallet interfaces and APIs.

Specifically, attackers could impersonate crypto services to replace deposit addresses or trick users into approving malicious transactions, Wang said. Such attacks would also require intercepting or redirecting users' internet traffic, and the compromised certificate authority keys alone would not expose wallet private keys.

Wang urged crypto operators to update their software and certificate trust stores and to verify that their applications reject the affected certificates — verification work that falls to each operator, since the browser-level blocks may not automatically reach applications outside those browsers.

Felix Ng contributed reporting.

Source: Cointelegraph