The exposure of eight weak private keys belonging to eMudhra, which verifies the identities of websites, prompted urgent action in browsers while also creating a conditional security risk for trading bots connected to exchanges and other software.
According to CoinDesk, a researcher named Wayne reported the vulnerability at India-based certificate authority eMudhra to browser makers on October 17. The researcher demonstrated the finding by digitally signing the warning message with the eight exposed keys.
Certificate authorities help verify that you are communicating with the correct server when connecting to a website. If these organizations’ signing keys are compromised, attackers can create fake certificates that appear trustworthy.
Eight keys were derived in less than a second
Security researcher Scott Helme said some of eMudhra’s private keys were small numbers such as 4, 56, and 115. According to Helme, all eight keys could be derived from publicly available certificates in less than a second, and the vulnerability had existed since April 2025.
Helme said, citing a Mozilla bug report, that the company attributed the issue to a bug in its key-generation script. CoinDesk also requested comment from eMudhra.
Why might the risk persist for trading bots?
The potential risk in crypto concerns, in particular, bots that connect to exchanges’ APIs, trading software, and the backend systems of wallets. If an application accepts a fake certificate and an attacker can intercept network traffic, communications with the exchange could be read or altered.
In tests conducted by Helme using a certificate that impersonated the Stripe API, clients based on curl, Python, Node, Go, and Java accepted the certificate. Based on the information reported in the article, no attacks targeting crypto users or other users had been reported.
A browser update does not update the certificate store used by a bot that runs independently of the browser. Moreover, because some software does not check whether certificates have been revoked, the certificate authority’s revocation action alone does not eliminate the risk in these applications.
Which systems took action?
Mozilla implemented a block within about three hours of the report, and Chrome also blocked the relevant certificates on October 17. Apple followed suit on October 19, and Microsoft on October 20. eMudhra also revoked the affected certificates.
Fixes were released for Go, Python’s certifi package, and Rust’s webpki-roots component. According to the latest check at the time the article was prepared, a fix for Node.js was still pending. For those operating bots, the key point is therefore to keep not only the browser but also the software and certificate components used by the application up to date.
Not investment advice.