Cryptocurrency users should take note beyond the browser as well. Exchange bots, trading scripts, and wallet backends frequently operate on Python, Node, or Go. A forged certificate for an exchange’s API could allow an attacker on the same network to intercept or modify a bot’s traffic. To date, no cryptocurrency attacks and no user attacks have been reported.
CoinDesk has reached out to eMudhra for comment.
Browser vendors and software developers have issued emergency patches. Mozilla received the report on October 17 after 8 p.m. UTC and implemented a block roughly three hours later. Chrome blocked the certificates the same day. Apple followed on October 19, and Microsoft on October 20. eMudhra has also revoked the affected certificates.
Mozilla warned that network interceptors could exploit these fraudulent certificates to impersonate trusted websites, potentially reading or altering user data.
The exact method by which the keys were exposed remains unknown.
According to researchers cited by Cyber Security News on X, eMudhra used small integers such as 4, 56, and 237 as private keys instead of robust 384-bit random numbers.
Security researcher Scott Helme elaborated further.
“One of eMudhra’s certificate authority private keys is the number 4,” he wrote. “Another is 56, and a third is 115.”