India's Computer Emergency Response Team (CERT-In) has issued a security advisory after eight intermediate Certificate Authority (CA) certificates belonging to Indian digital trust provider eMudhra were compromised, exposing a weakness that could allow attackers to impersonate legitimate websites and intercept encrypted communications.

Google and Mozilla have already blocked the affected certificates, while additional changes to browser trust stores are underway. For the Web3 ecosystem, the incident raises a broader security question. Although Ethereum, Bitcoin and decentralized applications rely on blockchain cryptography, most users still access these platforms through conventional websites, browsers and internet infrastructure.

How Weak Cryptographic Keys Exposed eMudhra's Certificates

According to CERT-In's advisory, the incident involved eight intermediate CA certificates within eMudhra's public key infrastructure (PKI), which supports secure communication and website authentication. Certificate authorities issue digital certificates that help browsers establish whether a website is authentic.

These certificates also support encrypted HTTPS connections, protecting information exchanged between users and online services. The affected certificates used P-384 elliptic-curve cryptography.

However, their associated private keys were generated with insufficient randomness, resulting in unusually small values that could be recovered almost instantly using publicly available information. In practical terms, attackers who recovered these keys could potentially issue fraudulent certificates that appeared to originate from a trusted authority.

If a vulnerable browser or application accepted such a certificate, an attacker capable of intercepting network traffic could impersonate a legitimate website or interfere with encrypted communications. eMudhra stated that the affected certificates were created during a key-generation ceremony in April 2025.

The company maintains that its root CA private keys and other intermediate authorities remain unaffected. It also reported that none of the compromised intermediate authorities had issued end-entity certificates.

Similar questions about cryptographic security have emerged in cryptocurrency incidents, including Legacy Ethereum Wallets Exploited as $800K Gets Drained, where weaknesses involving older wallet private keys reportedly exposed user funds. Another case, What the COLDCARD Exploit Means for Crypto?, highlighted the consequences of weaknesses in wallet seed generation.

Google and Mozilla Move to Block Compromised Certificates

Major browser developers responded after security researchers reported the compromised certificate keys on October 17. According to Google's security disclosure, Chrome received the report on October 17 and deployed an emergency Certificate Revocation List Set (CRLSet) update later that day.

The update blocked the public keys associated with the six affected TLS-issuing intermediate authorities, preventing Chrome from trusting certificates that relied on those keys. Google also reported that no TLS certificates chaining to those six authorities had appeared in Certificate Transparency logs before the blocking action.

Because Chrome requires Certificate Transparency for publicly trusted certificates by default, fraudulent certificates issued under those authorities could not have been accepted through its normal certificate-validation process before the block. Mozilla received its report on October 17 and distributed protections through Firefox's OneCRL certificate block list.

The company subsequently released Firefox 158.0.1 and corresponding Extended Support Releases to protect users whose configurations prevented them from receiving the automatic updates. Mozilla is also removing the affected root certificate from its Network Security Services trust store.

Google separately announced that emSign ECC Root CA - G3 would be removed from the Chrome Root Store, with the broader rollout expected on October 27. This could affect legitimate websites whose certificates depend on that root, requiring operators to obtain replacement certificates from unaffected authorities.

In Web3, emergency coordination is similarly important when security incidents affect multiple applications or interconnected services. For example, DeFi Unites After KelpDAO $292M Hack documented how multiple protocols coordinated their responses after a major ecosystem exploit.

Why the Incident Matters for Crypto Exchanges, Wallets and DeFi

The eMudhra compromise did not directly affect Ethereum's consensus mechanism, smart contracts or blockchain transaction signatures. Its relevance to Web3 comes from the infrastructure users depend on before interacting with blockchain networks.

Cryptocurrency exchanges, DeFi applications, NFT marketplaces and wallet dashboards commonly operate through HTTPS-enabled websites. Users typically access these interfaces, connect their wallets and approve blockchain transactions without independently verifying every component of the website's infrastructure.

If attackers successfully impersonated a legitimate crypto website through fraudulent certificates and controlled a victim's network connection, they could potentially display deceptive wallet prompts or manipulate information presented to users. Such attacks would require additional conditions beyond possessing a compromised certificate, including an opportunity to intercept traffic and a client that accepted the forged certificate.

EtherWorld previously covered India's Cybercrime Unit Warns of Rising Trust Wallet Scams, which examined fraudulent wallet verification websites and malicious scripts designed to drain cryptocurrency holdings. In another incident, Ethereum Phishing Attack Drains $585K in 11 Hours, attackers reportedly convinced users to sign malicious token approvals rather than exploiting vulnerabilities in Ethereum itself.

Both cases demonstrate how attackers can exploit user trust and wallet interactions without compromising blockchain consensus. Website impersonation could potentially provide another route for presenting such malicious requests.

EtherWorld's coverage of the SafePal Data Breach Exposes 40K Customer Records similarly highlighted how weaknesses outside wallet cryptography can create opportunities for phishing and impersonation. The Crypto RAT Malware Drains $235K in 48 Hours report also illustrated the growing importance of securing devices, browser extensions and software used to interact with digital assets.

What Web3 Platforms and Users Should Do Next

CERT-In has recommended that organizations, software developers and website administrators review certificate dependencies, apply browser security updates and verify that their systems receive certificate revocation information. For cryptocurrency exchanges and Web3 infrastructure operators, this includes examining whether their websites or applications depend on the affected eMudhra certificate chains.

Services using certificates associated with emSign ECC Root CA - G3 may need to migrate to another trusted certificate hierarchy to avoid disruptions as browser vendors remove trust.

Importantly, a secure HTTPS connection confirms aspects of website identity and communication security. It does not guarantee that the website's smart contracts, transactions or business operations are safe. EtherWorld's North Korean Hackers Behind $285M Drift Protocol Hack coverage highlighted how sophisticated attackers can exploit operational processes and human trust rather than relying exclusively on technical vulnerabilities.

Similarly, How $900 Bought Control of an $8.5M DeFi Vault demonstrated that decentralized systems can face security failures through governance and authorization mechanisms. The broader pattern is reflected in EtherWorld's August 2026 Among Worst Months for DeFi Hacks and April 2026 Worst for DeFi, Over $635M Lost in Exploits, which documented vulnerabilities across different parts of the cryptocurrency ecosystem.

Efforts such as Securing Ethereum Together: Giveth & TheDAO's QF Approach also demonstrate growing ecosystem attention toward security infrastructure, threat monitoring and user protection. For now, eMudhra continues investigating the certificate-generation failure, while browser vendors have taken steps to contain the potential risk.

To promote your Web3 articles, events, and projects, you may reach out anytime via EtherWorld PR for submissions and collaboration.

Related Articles

• Legacy Ethereum Wallets Exploited as $800K Gets Drained
• India's Cybercrime Unit Warns of Rising Trust Wallet Scams
• Ethereum Phishing Attack Drains $585K in 11 Hours
• SafePal Data Breach Exposes 40K Customer Records
• Crypto RAT Malware Drains $235K in 48 Hours

To follow blockchain news, track Ethereum protocol progress, and read our latest stories, subscribe to our weekly today.

Join the EtherWorld & Avarch Internship Program and build your career in blockchain, content, social media, video, podcast editing, or operations. Send your resume and brief introduction to contact@etherworld.co.