CertiK Warns Crypto Bots and Exchange Apps May Still Be Exposed to eMudhra Certificate Flaw
CertiK says crypto apps may still face risk
Blockchain security company CertiK says crypto trading bots and exchange applications may still be exposed to a security flaw in certificates issued by India's eMudhra. That is despite emergency fixes from major technology companies.
CertiK's senior director of digital assets security, Peiyu Wang, told Cointelegraph that the browser fixes may not protect crypto software that uses separate security systems. Certificates are digital documents that help confirm a website or service is genuine.
Eight certificates blocked by Tuesday
- Google, Apple and Microsoft had blocked eight vulnerable certificates issued by eMudhra by Tuesday, the report said.
- CertiK says the blocks help clients that receive and enforce them, but some software outside browsers does not enforce Certificate Transparency or receive the same revocation protections.
- Wang said crypto services are not more vulnerable to the flaw than other industries.
What CertiK says attackers could try
Wang said attackers could use compromised certificates to impersonate the HTTPS connections used by exchanges, wallet interfaces and APIs. An exchange is a platform where people trade crypto, a wallet interface is the software used to manage crypto, and an API is a tool that lets programs talk to a service.
He said attackers could impersonate crypto services and replace deposit addresses or trick users into approving harmful transactions.
What would still be required to carry out an attack
Wang said such attacks would also need attackers to intercept or redirect a user's internet traffic. He said the compromised certificate authority keys alone would not expose wallet private keys, which are the secret codes that control crypto funds.
CertiK's advice for crypto operators
Wang urged crypto operators to update their software and certificate trust stores. He also said they should verify that their applications reject the affected certificates.
What is confirmed
The report states that Google, Apple and Microsoft had blocked eight vulnerable eMudhra certificates by Tuesday. It also confirms that CertiK made the warning and that Wang gave the quoted comments to Cointelegraph. The article was published on Oct. 21, 2026.
What is still unclear
The source does not say whether any crypto service has actually been attacked or harmed. It does not name which bots, exchanges or applications may still be at risk. The warning about remaining exposure comes from CertiK, not from an official regulator or from eMudhra.
Why this matters for crypto users
Crypto services rely on secure internet connections to move funds and confirm transactions. If a certificate is abused, users could be sent to a fake service that looks real, which is why operators are being told to check their own systems rather than assuming browser fixes are enough.
Sources
Newisty Editorial Team covers technology, cryptocurrency, digital products, online platforms, developer tools and the wider digital economy. Our content is researched from official sources, company announcements, public documentation, market data and other primary or reputable sources. Articles are reviewed and edited before publication for clarity, accuracy and useful context.