Indian Cybersecurity Agency Warns of AI-Powered Attacks on Crypto Exchanges

India identifies CRAFTY FALCON targeting crypto firms

India’s national cybersecurity agency, the Indian Computer Emergency Response Team (CERT-In), has issued a warning regarding an escalating hacking campaign. The threat actor, identified as CRAFTY FALCON, is using artificial intelligence (AI) to target cryptocurrency exchanges—platforms where people buy and sell digital assets—and other financial businesses.

The agency reported that these AI-assisted attackers are stealing wallet keys, which are private digital codes used to access and move cryptocurrency. Once they have these keys, the hackers siphon funds from the victims' accounts. The campaign is described as active and ongoing, with several financial entities reporting successful breaches even after receiving previous warnings.

Automated attacks moving at machine speed

• The attackers use AI to survey targets and strike at "machine speed" by using a company’s own payment systems.
• Targets include crypto exchanges, digital lending platforms, fintech companies, and payment service providers.
• Hackers use AI tools to quickly write and improve malicious scripts and reverse-engineer software code.
• Many attacks are timed for weekends and holidays when security staffing is often lower.

Official findings from India’s cybersecurity agency

According to CERT-In, the CRAFTY FALCON campaign has evolved since it was first detected in October. The agency noted that attackers are exploiting vulnerable applications and testing environments. They use shared login credentials and access tokens to move from testing areas into live production systems, where they can deploy malicious files into cloud infrastructure.

In some cases, the hackers performed small test transactions to confirm they had control over a system before moving larger amounts of money. CERT-In has advised all at-risk businesses to treat this threat as escalating and to lower their alert thresholds to catch suspicious activity more quickly.

How AI is used to breach financial systems

Other reports support the findings that AI tools are being used against financial institutions. In October, cybersecurity firm CrowdStrike noted that an attacker used an AI tool called ARTEX, along with other AI models like Claude Code, to breach financial firms in South Korea. These tools help hackers generate tailored exploits that are difficult to detect using traditional security methods.

Confirmed details of the security breaches

It is confirmed that CRAFTY FALCON has successfully targeted non-bank lenders, fintech entities, and crypto exchanges. The theft of cryptocurrency wallet keys and the draining of funds have been officially reported by CERT-In. The agency also confirmed that the attackers are using machine intelligence to operate faster than human-led security teams can often respond.

What remains unknown about the hacks

While the threat is confirmed, CERT-In has not publicly named the specific crypto exchanges or companies that have lost funds. The total amount of money stolen across all affected businesses has also not been disclosed. Additionally, it is not yet clear which specific individuals or groups are behind the CRAFTY FALCON identity.

Why faster security responses are needed

The use of AI in hacking means that defensive teams must also have access to advanced AI tools. Security experts suggest that because attack techniques are moving faster than traditional security audits can handle, companies need continuous security reviews and 24-hour monitoring to protect digital assets from automated threats.

Sources

• Cointelegraph