eMudhra Key Leak Exposes Risks for Browsers and Crypto Tools
Mozilla, Chrome, Apple, and Microsoft quickly rolled out blocks. The leaked eMudhra keys could also affect API traffic from exchanges, wallets, and bots.
Key Takeaways
- Eight private keys from eMudhra were compromised, making it possible to create fake certificates for websites.
- Browsers and software makers quickly rolled out emergency fixes; Mozilla, Chrome, Apple, and Microsoft blocked the affected certificates.
- Crypto tools that use certificates for exchanges and wallets are at risk, although no crypto attacks have been reported yet.
Browsers and software makers rolled out emergency fixes after eight private keys at eMudhra, an Indian certificate authority, were found to be compromised. The issue affects not only web security, but also crypto tools that use certificates to communicate with exchanges, wallets, and other services.
What Went Wrong Exactly
The report came on October 17 from researcher Wayne. To prove the flaw, he used all eight compromised keys to digitally sign his warning. According to the report, the keys could be used to create seemingly valid certificates for websites.
That is risky because browsers and other software rely on digital certificates to check whether a site is real. According to The Register, eMudhra has issued more than 60 million certificates. If a certificate authority's private key leaks or gets cracked, an attacker can forge certificates that look trustworthy.
Why Crypto Users Should Pay Attention
For crypto users, this matters mostly outside the browser. Many exchange bots, trading scripts, and wallet backends run on Python, Node, or Go and rely on the same certificate chain to keep traffic secure. A fake certificate for an exchange API could, in theory, let someone on the same network read or alter traffic.
So far, no crypto attacks have been reported, and there have been no attacks on users either. Mozilla warned that network interceptors with these fake certificates can imitate trusted sites and read or change data.
Quick Fixes, Open Questions
Mozilla had a block ready within about three hours of the report. Chrome blocked the certificates later that same day, Apple followed on October 19, and Microsoft on October 20. eMudhra also revoked the affected certificates.
It is still not clear exactly how the keys leaked. Researchers say eMudhra used extremely weak private keys, such as small numbers instead of strong random 384-bit values. Scott Helme said he was able to extract the eight keys from public certificates in less than a second and that they had been visible since April 2025. According to his tests, tools like curl, Python, Node, Go, and Java accepted a forged certificate for Stripe's API, although fixes are now available for Go, Python's certifi package, and Rust's webpki-roots. Node.js was still open at the last check.
