Indian Digital Certificate Authority eMudhra Private Key Leak May Threaten Security of Cryptocurrency Trading and Other Systems

On October 21, according to CoinDesk, Indian digital certificate authority eMudhra suffered from a flaw in its key provisioning script that utilized extremely weak numerical values as private keys, resulting in the cracking and leakage of 8 private keys. Attackers could exploit these forged digital certificates to impersonate trusted websites and launch man-in-the-middle attacks to steal or tamper with data. This vulnerability poses a widespread risk, primarily threatening users running outdated or unpatched software. Google Chrome, Firefox, Apple, and Microsoft have urgently blocked the relevant certificates, and eMudhra has also initiated revocation procedures. However, since the development environments commonly used by exchange quant bots, automated trading scripts, and wallet backends may not always check certificate revocation statuses, testing shows that some development tools may still accept forged certificates. Related underlying toolchains are sequentially rolling out patches, and industry insiders advise cryptocurrency users and developers to promptly update wallets, trading tools, and system dependency libraries to mitigate security risks.