India’s CERT-In Highlights Escalating AI-Driven Cyberattacks on Crypto Exchanges

The Indian Computer Emergency Response Team (CERT-In) on Wednesday formally identified this AI-enabled threat actor as “CRAFTY FALCON” in an update to a campaign first reported in October. This latest advisory specifically named crypto exchanges among the victims and detailed the use of AI-powered tools in the attacks.

CERT-In stated, “This threat remains active and ongoing. The CSIRT-Fin team continues to receive reports of successful breaches, including from non-banking financial companies (NBFCs) and fintech firms that had received earlier limited alerts and implemented mitigation measures.”

The warning adds further proof of hackers exploiting AI technologies against financial institutions. In October, cybersecurity firm CrowdStrike reported an unidentified attacker using an AI penetration-testing tool called ARTEX—also referenced by CERT-In—alongside Claude Code and other AI models to compromise South Korean financial companies and steal data.

CERT-In described CRAFTY FALCON as operating at “machine speed,” employing machine intelligence to study targets and leveraging the victims’ own payment and disbursement API systems to launch attacks.

This campaign focuses on non-bank lenders, digital credit platforms, fintech companies, payment aggregators, service providers, as well as cryptocurrency exchanges.

Attackers exploited vulnerable applications and exposed testing environments, using shared credentials and access tokens to gain entry into production systems. They also targeted cloud infrastructures to host malicious files.

AI tools enabled rapid creation and refinement of attack scripts. The attackers reverse-engineered application code to craft custom exploits. Some attacks were strategically scheduled on weekends and holidays to delay detection.

In certain attacks, threat actors conducted small test transactions to confirm unauthorized access before transferring large amounts. CERT-In also reported theft of crypto wallet keys and draining of funds from wallets.

The agency did not disclose specific crypto exchanges affected nor the scale of the financial losses incurred.

CERT-In contacted multiple industry players including CoinDCX, CoinSwitch, WazirX, ZebPay, and Mudrex for comments, while also maintaining communication with the cryptocurrency community.

CERT-In advises organizations to consider this threat active and escalating, recommending that high-risk companies enhance 24/7 security monitoring, increase staffing, and lower alert thresholds during holidays, weekends, and other periods prone to reduced oversight.

Michael Coates, Chief Information Security Officer at the Solana Foundation, previously told Cointelegraph that legitimate security teams must have access to the most advanced AI tools.

He emphasized, “It is essential to ensure that the best available AI models are in the hands of defenders because attackers will have equally capable tools.”

Ari Redbord, Head of Policy at TRM Labs, also told Cointelegraph in July that attack methods evolve faster than what can be detected by a single audit after deployment, urging continuous security assessments.

why

This development highlights the increasing sophistication of cyberattacks using AI against financial systems, emphasizing the urgent need for continuous security vigilance and advanced defensive tools in the industry.