India’s CERT-In Flags AI-Powered Crypto Exchange Hack Attacks

India’s Computer Emergency Response Team (CERT-In) has identified an active, AI-assisted threat actor dubbed “CRAFTY FALCON” targeting cryptocurrency exchanges, nonbank lenders, fintech companies, payment aggregators and other financial businesses. The agency said attackers have stolen cryptocurrency wallet keys, drained funds and successfully compromised organizations that had already received earlier warnings and implemented remediation. CERT-In has not publicly named the affected crypto exchanges or disclosed the scale of the losses.

CRAFTY FALCON reportedly surveys targets using AI, operates at “machine speed” and abuses victims’ own payment and disbursement APIs to execute unauthorized transfers. According to CERT-In, the group exploits vulnerable applications and exposed testing environments, leverages shared credentials and access tokens, and targets cloud infrastructure to deploy malicious files. AI tools help generate and refine attack scripts, reverse-engineer application code and create targeted exploits, while weekend and holiday attacks are designed to delay detection.

The campaign has also used small test transactions to validate stolen payment access before transferring larger sums. CERT-In said some stolen wallet keys were used to drain cryptocurrency balances. Earlier reporting from CrowdStrike documented an unidentified attacker combining ARTEX, an AI penetration-testing tool, with Claude Code and other AI models to breach financial institutions in South Korea and steal data, providing further evidence of AI-assisted attacks against the sector.

Crypto exchanges and financial technology companies are advised to address exposed applications, eliminate insecure test environments, rotate compromised credentials and tokens, monitor cloud workloads, and closely review anomalous payment API activity. Additional controls include restricting access to disbursement systems, requiring stronger approval for fund movements and continuously testing whether unauthorized test transfers can reach production accounts.