#btc
The private keys of 8 intermediate certificate authorities were so weak they could be calculated directly from public certificates
Browsers blacklisted these certificates first, but some Ethereum clients kept trusting them
📣 盘面异动群里喊
On October 17, security researchers discovered this random-number flaw at Indian certificate authority eMudhra
The problem was in the key-generation step: there wasn’t enough randomness, so the private keys were effectively half-public
Anyone who got hold of these 8 private keys could sign a certificate that unpatched software would accept as genuine
Browser vendors acted first. A day later, eMudhra revoked the intermediate certificates and announced it was exiting the certificate business
The real trap was Java
Java doesn’t check whether certificates have been revoked by default
So Teku’s prebuilt Docker images kept trusting these certificates even after browsers blacklisted them
Teku released a new version on Tuesday, and Besu released one on Monday. Both removed eMudhra from their trust lists 🔐
The attack path isn’t complicated
A node positioned between a validator and the service it connects to could impersonate that service
A deceived validator might propose a block that sends the transaction fees to the attacker’s address
Even more concerning are fake external signing services: they hold the signing authority to change the reward withdrawal address 💥
Teku classified this scenario as the highest risk
To be clear, mainnet Teku nodes running the default configuration are not affected and don’t need to do anything
There are currently no reports of actual exploitation. The issue was first reported by Consensys Diligence
But anyone running a client directly on their own hardware has work to do
Just upgrading your Ethereum software isn’t enough; Java’s trust list won’t change along with it
A new Docker image won’t fix the Java installation on the host machine, either
Those still on Java 26 have an even bigger problem: that version is no longer supported and has no patches, so they’ll have to upgrade to Java 25 ⚠️
My take: what this incident exposed wasn’t Ethereum’s consensus layer, but the decades-old internet infrastructure beneath it
Certificate authorities, random numbers, Java’s default behavior
If any one link is weak, even the most robust blockchain can be bypassed from the side 🦖
Ordinary ETH holders don’t need to worry about this one
For stakers and people running their own nodes, it’s a reminder: who exactly maintains your trust list?
ETH is currently around $2,309, down 2% in a day. BTC is around $79,830, down 1.41% in a day
The broader market is falling. Infrastructure fixes like this won’t be priced in over the short term, but they will be eventually
Let’s talk in the comments: do you know anyone running their own node? When did they last update Java?
Every day, we bring you the latest crypto security developments—not just what happened, but the logic and opportunities behind the headlines 👀🚀
The private keys of 8 intermediate certificate authorities were so weak they could be calculated directly from public certificates
Browsers blacklisted these certificates first, but some Ethereum clients kept trusting them
📣 盘面异动群里喊
On October 17, security researchers discovered this random-number flaw at Indian certificate authority eMudhra
The problem was in the key-generation step: there wasn’t enough randomness, so the private keys were effectively half-public
Anyone who got hold of these 8 private keys could sign a certificate that unpatched software would accept as genuine
Browser vendors acted first. A day later, eMudhra revoked the intermediate certificates and announced it was exiting the certificate business
The real trap was Java
Java doesn’t check whether certificates have been revoked by default
So Teku’s prebuilt Docker images kept trusting these certificates even after browsers blacklisted them
Teku released a new version on Tuesday, and Besu released one on Monday. Both removed eMudhra from their trust lists 🔐
The attack path isn’t complicated
A node positioned between a validator and the service it connects to could impersonate that service
A deceived validator might propose a block that sends the transaction fees to the attacker’s address
Even more concerning are fake external signing services: they hold the signing authority to change the reward withdrawal address 💥
Teku classified this scenario as the highest risk
To be clear, mainnet Teku nodes running the default configuration are not affected and don’t need to do anything
There are currently no reports of actual exploitation. The issue was first reported by Consensys Diligence
But anyone running a client directly on their own hardware has work to do
Just upgrading your Ethereum software isn’t enough; Java’s trust list won’t change along with it
A new Docker image won’t fix the Java installation on the host machine, either
Those still on Java 26 have an even bigger problem: that version is no longer supported and has no patches, so they’ll have to upgrade to Java 25 ⚠️
My take: what this incident exposed wasn’t Ethereum’s consensus layer, but the decades-old internet infrastructure beneath it
Certificate authorities, random numbers, Java’s default behavior
If any one link is weak, even the most robust blockchain can be bypassed from the side 🦖
Ordinary ETH holders don’t need to worry about this one
For stakers and people running their own nodes, it’s a reminder: who exactly maintains your trust list?
ETH is currently around $2,309, down 2% in a day. BTC is around $79,830, down 1.41% in a day
The broader market is falling. Infrastructure fixes like this won’t be priced in over the short term, but they will be eventually
Let’s talk in the comments: do you know anyone running their own node? When did they last update Java?
Every day, we bring you the latest crypto security developments—not just what happened, but the logic and opportunities behind the headlines 👀🚀