Security· ★★★· bearish·

Weak eMudhra certificate keys expose crypto trading bots to interception risk

  • —All eight eMudhra keys were derivable from public certificates in under a second
  • —The flaw dated to April 2025 and stemmed from a key-generation script bug
  • —Mozilla blocked the certificates in about three hours; Chrome on Oct. 17, Apple and Microsoft on Oct. 19-20
  • —Helme's tests showed curl, Python, Node, Go and Java clients accepted a fake Stripe API certificate
Why it matters: Bots and wallet backends do not refresh their certificate stores with browser updates, so the risk of API traffic interception remains until Node.js and other components are patched.
Source: Koin Bülteni
More on this
Security · Sep 21
MEV Bot Yoink Front-Runs $7.7M rsETH Exploit, Kelp Freezes Intercepted Funds
 Security · Sep 16
MEV bot Yoink intercepts 2,882 rsETH from hacker who attacked Safe wallet
 Security · yesterday
Starknet flags 1.7M BTC in addresses exposing public keys to quantum risk