Google, Apple and Microsoft blocked eight vulnerable certificates issued by India’s eMudhra, but cryptocurrency trading bots and exchange apps may remain exposed if they use separate security systems, according to blockchain security company CertiK. CertiK’s Peiyu Wang said browser protections reduce risk for clients that receive and enforce them, while some apps outside browsers lack the same protections.
Wang said crypto services are not inherently more susceptible than other industries. An attacker could impersonate a crypto service to replace a deposit address or prompt a malicious transaction, but would also need to intercept or redirect a user’s internet traffic. Compromised certificate authority keys alone would not expose wallet private keys.
