India Warns AI-Driven Hackers Targeting Crypto Exchanges at Scale

India’s national cybersecurity agency has warned that an AI-assisted threat actor is stepping up attacks against cryptocurrency exchanges and other financial businesses, including theft of cryptocurrency wallet keys and unauthorized drainage of funds. The update, issued by the Indian Computer Emergency Response Team (CERT-In), names the group “CRAFTY FALCON” and says the campaign is active and escalating.

CERT-In’s Wednesday advisory expands on an earlier alert from October by explicitly including crypto exchanges among the affected targets. The agency also described how the actor blends machine-assisted reconnaissance with automated exploitation techniques, using victim systems—such as payment and disbursement application programming interfaces (APIs)—to carry out transfers.

Key takeaways

• CERT-In designated the threat actor “CRAFTY FALCON” in an update to its October warning, now explicitly naming cryptocurrency exchanges as targets.
• The agency says the campaign is ongoing, with CERT-In’s financial incident response unit (CSIRT-Fin) continuing to receive reports of successful attacks.
• According to CERT-In, attackers used AI tools to generate and refine attack scripts, and they exploited vulnerable applications and testing environments.
• CERT-In reported that stolen cryptocurrency wallet keys were involved in some incidents, alongside wallet fund drains.
• CERT-In urged at-risk organizations to treat the campaign as active and to increase around-the-clock monitoring during weekends and holidays.

Why CERT-In’s crypto-specific update matters

While AI-enabled phishing and automation have been discussed widely in cybersecurity circles, CERT-In’s latest warning is notable because it moves beyond generic financial-sector risk and directly points to cryptocurrency exchanges. This matters for crypto operators because exchange and custody systems often integrate multiple components—key management, withdrawal workflows, wallet access controls, and third-party services—that can create high-impact paths for attackers once initial access is gained.

CERT-In said CSIRT-Fin continues to receive reports of successful attacks, including involving nonbank financial companies (NBFCs) and fintech firms that had already received earlier restricted advisories and reportedly carried out remediation. That detail suggests remediation efforts may not have fully closed the specific gaps exploited by this campaign, or that the attacker is adapting to defensive changes.

“Machine speed” operations and API abuse

CERT-In described CRAFTY FALCON as a threat actor that “surveys its targets with machine intelligence” and operates “at machine speed.” The advisory further claims the attackers “strike by invoking the victim’s own payment and disbursement APIs,” indicating that the compromise isn’t limited to exfiltration—it can directly translate into unauthorized fund movement.

Beyond exchanges, CERT-In lists a broad set of targets that includes nonbank lenders, digital lending platforms, fintech companies, payment aggregators, and service providers. The pattern aligns with an attack model where once a foothold is established—through exposed vulnerabilities or credential misuse—criminals can reuse legitimate workflows inside enterprise systems.

The agency also said the attackers exploited vulnerable applications and exposed testing environments, including using shared credentials and access tokens to move into production systems. In parallel, CERT-In stated attackers targeted cloud infrastructure to deploy malicious files, suggesting the intrusion chain likely blends application-layer weaknesses with infrastructure-level persistence.

How AI tooling changes the attacker’s workflow

CERT-In’s advisory emphasizes that AI tools played a role in accelerating the development of attack capabilities. The agency says the attackers used AI to rapidly generate and refine attack scripts and even reverse-engineered application code to craft tailored exploits for specific victims.

Operationally, CERT-In added that some attacks were timed for weekends and holidays to delay detection—an approach that’s particularly concerning in financial environments where staffing coverage can drop during off-hours. The agency also described the use of small test transactions to validate unauthorized transfers before scaling to larger sums in some incidents.

These elements—automation, rapid iteration, code tailoring, and testing transfers—help explain why CERT-In’s updated advisory frames the threat as active and escalating. Even when an organization addresses one vulnerability, attackers that can quickly iterate are more likely to find alternative pathways.

Wallet key theft and what CERT-In didn’t disclose

In the context of cryptocurrency activity, CERT-In reported that stolen cryptocurrency wallet keys and funds drained from wallets were involved in some incidents. However, the agency did not name any specific crypto exchanges, nor did it quantify losses.

That absence of named victims and figures can make it harder for market participants to assess exposure directly. Still, the warning provides concrete indicators of the types of failures that can be exploited—such as weak key protections, insufficient segmentation between testing and production, and inadequate control of credential reuse and access tokens.

Cointelegraph reported that it reached out to CERT-In and several crypto-related companies for comment, including CoinDCX, CoinSwitch, WazirX, ZebPay, and Mudrex. No additional outcomes from those requests were provided in the source material.

Defensive guidance: monitoring during low-coverage windows

CERT-In advised organizations to “treat this campaign as active and escalating.” The agency’s recommended direction focuses on improving operational security posture, including heightened security monitoring around the clock. CERT-In also called for increased staffing and lowered alert thresholds during holidays, weekends, and other periods of low coverage—conditions under which CERT-In says attackers may have timed activity to avoid early detection.

The advisory underscores a broader challenge facing both traditional finance and crypto infrastructure: security teams must be able to respond faster than attackers can probe and adapt. Earlier coverage from Cointelegraph included comments from Solana Foundation’s chief information security officer, Michael Coates, who argued that defenders need access to the strongest AI tools because attackers will too. Separately, TRM Labs policy head Ari Redbord told Cointelegraph in July that attack methods can outpace what a single security audit can cover once threats evolve.

For investors and operators, the next signal to watch is whether CERT-In’s guidance leads to concrete changes in controls across exchange withdrawal and wallet management pipelines—especially around key access, API permissions, environment separation, and how quickly anomalies are detected during weekend and holiday coverage gaps.