Eight private keys linked to Indian certificate authority eMudhra were compromised after researchers found they were based on easily guessed numbers, creating a potential route for attackers to impersonate trusted websites and intercept online communications.
The incident prompted rapid action from major browser makers. Mozilla, Chrome, Apple and Microsoft blocked the affected certificates, while eMudhra revoked them. No attacks have been reported, but older or non-browser software that does not check certificate revocation may still be exposed.
How the certificates became a security problem
Certificate authorities, or CAs, are companies trusted to confirm that websites are genuine. When a user opens a secure website, the browser checks the site’s digital certificate and the CA’s signature. That process is intended to prevent attackers from presenting a fake site as a legitimate one.
A CA’s private key is central to that system. It functions like a master stamp: anyone who obtains or reconstructs it may be able to create certificates that appear authentic. In this case, eight private keys associated with eMudhra were recovered from information contained in public certificates.
The issue was reported to browser makers on Oct. 17 by a researcher identified as Wayne. To demonstrate the weakness, he used all eight keys to digitally sign a message saying, “We have a problem here – Wayne.” According to the reporting, researchers were able to recover the keys in less than a second.
The affected company has issued more than 60 million certificates, according to The Register. The source material does not indicate that all of those certificates were affected; the confirmed issue concerned eight private keys.
Researchers said the keys were not generated as large, unpredictable values. Instead, they reportedly included small integers such as 4, 56, 115 and 237, rather than strong 384-bit random numbers. Security researcher Scott Helme said one of the keys was the number 4 and that another was 56.
The keys may have been exposed since April 2025. A reading of a Mozilla security ticket attributed the failure to a bug in eMudhra’s key-setup script, although the exact circumstances remain unclear. CoinDesk reported that it contacted eMudhra for comment.
Emergency blocking and remaining exposure
Mozilla received the report after 8 p.m. UTC on Oct. 17 and had blocked the certificates roughly three hours later. Chrome also blocked them that day. Apple followed on Oct. 19, and Microsoft acted on Oct. 20. eMudhra separately revoked the certificates.
Revocation tells compatible software that a certificate should no longer be trusted. However, not every program checks revocation status reliably. That means removing the certificates from browser trust systems does not necessarily eliminate the risk for other applications.
Mozilla warned that a network interceptor could use a fraudulent certificate to impersonate a trusted website. In a so-called man-in-the-middle attack, an attacker positioned between a user and a service may be able to read or alter traffic that the software incorrectly accepts as secure.
Security researcher Scott Helme said his tests found that tools and programming environments including curl, Python, Node, Go and Java accepted a forged certificate for Stripe’s API. Updates were available for Go, Python’s certifi package and Rust’s webpki-roots, while Node.js was still pending when the source material was checked.
The problem is therefore wider than web browsers. A browser that has received the emergency block may reject the compromised certificates, while an older application or a program that does not perform revocation checks could continue accepting them.
Implications for crypto software
Crypto users could face the same type of exposure when they rely on software that communicates with exchanges or other online services. Exchange bots, trading scripts and wallet backends commonly operate through Python, Node or Go. In theory, an attacker on the same network could use a forged certificate for an exchange API to read or modify a bot’s traffic.
There have been no reported crypto attacks connected to the incident. Mudit Gupta, chief technology officer at Polygon Labs, told CoinDesk that the vulnerability is not specific to cryptocurrency and is better understood as a general software-security problem, particularly for people using older or unpatched systems.
Gupta said crypto users who keep their wallets, trading tools and devices updated face lower risk, while the broader software ecosystem remains the main concern. The distinction matters because the weakness sits in the infrastructure used to establish online trust, rather than in a blockchain network or a particular digital asset.
Moneyiar market picture
Moneyiar data at 08:29 on Oct. 21, 2026, showed the following market moves:
- Compound (COMP): $25.5939848406, up 19.13% over 24 hours and 11.09% over seven days.
- ECOMI (OMI): $0.0002840737, up 3.70% over 24 hours and 0.31% over seven days.
- Notcoin (NOT): $0.0004074002, up 3.38% over 24 hours and down 8.61% over seven days.
- Prom (PROM): $5.1954234658, up 8.35% over 24 hours and 0.20% over seven days.
These market movements are separate from the eMudhra certificate incident; the source material reports no crypto attack arising from the compromised keys.
