India Warns of AI-Driven Attacks on Crypto Exchanges at Machine Speed

India’s national cybersecurity agency has escalated a warning about an AI-assisted hacking campaign it says is actively targeting financial services—including cryptocurrency exchanges. The Indian Computer Emergency Response Team (CERT-In) on Wednesday designated the threat actor as “CRAFTY FALCON,” continuing a campaign update it first issued in October.

In its latest advisory, CERT-In said it has received reports of successful intrusions against organizations that had previously been covered by earlier restricted notices, including nonbank financial companies (NBFCs), fintech entities, and now crypto exchanges. The agency did not name specific exchanges or quantify losses, but it described how the attackers combine AI-driven tooling with direct interaction with victims’ payment and disbursement systems.

Key takeaways

• CERT-In has identified the campaign actor as “CRAFTY FALCON” and says the threat is still active and escalating.
• Crypto exchanges are explicitly named among affected business types, along with NBFCs, fintechs, and payment providers.
• CERT-In attributes key tactics to AI-enabled operations, including faster script generation and refinement.
• Reported compromises include theft of cryptocurrency wallet keys and unauthorized draining of funds, though victims and totals were not provided.
• The agency urges organizations to treat the campaign as ongoing, increasing monitoring and staff coverage during weekends and holidays.

From restricted warning to crypto-specific escalation

CERT-In’s October advisory flagged an AI-assisted financial threat and recommended remediation. This week’s update is broader in scope and more specific in application: it now includes cryptocurrency exchanges among the kinds of businesses being attacked.

In the agency’s statement, the threat is “active and ongoing,” and the CERT-In Financial Sector Incident Response Team (CSIRT-Fin) continues to receive reports of successful attacks. CERT-In emphasized that some of the impacted organizations had already received prior restricted advisories and claimed they had undertaken remediation—yet intrusions are still being reported.

This matters for crypto operators because it suggests that mitigation efforts may be falling short against attacker playbooks that evolve quickly. It also signals that regulators and national incident-response teams are treating crypto businesses as part of the broader financial attack surface rather than a separate category.

“Machine speed” tactics and exploitation paths

CERT-In described CRAFTY FALCON as a threat actor that uses “machine intelligence” to survey targets, operate at “machine speed,” and strike by invoking victims’ own payment and disbursement APIs. That framing is significant: instead of relying solely on brute force or purely external exploitation, the campaign appears designed to leverage how applications move value internally.

The advisory also states that the campaign has targeted a wide range of financial ecosystem participants, including:

• Nonbank lenders and digital lending platforms
• Fintech companies
• Payment aggregators and related service providers
• Crypto exchanges

CERT-In said attackers exploited vulnerable applications and accessed exposed testing environments. It also cited common compromise enablers such as shared credentials and access tokens used to reach production systems. In addition, attackers targeted cloud infrastructure to deploy malicious files.

Operationally, CERT-In linked the speed of attack development to AI tooling. The agency said AI tools helped attackers rapidly generate and refine attack scripts, while the attackers also reverse-engineered application code to create tailored exploits. CERT-In further noted that some attacks were scheduled for weekends and holidays—timing aimed at delaying detection when operational coverage is typically lower.

How attackers validated transfers and stole wallet access

One of CERT-In’s most concerning details is that it reported stolen cryptocurrency wallet keys and funds drained from wallets in certain incidents. The agency also described a pattern in which attackers used small test transactions to confirm unauthorized transfers before moving larger sums.

That combination—testing unauthorized activity and then scaling—can be particularly damaging for crypto businesses because it can help attackers identify weaknesses in internal controls, approval flows, and monitoring thresholds. Even when exchanges have standard defenses in place, the strategy can be designed to blend malicious activity into expected transaction behavior.

However, CERT-In did not name which exchanges were affected or provide loss estimates. As a result, readers should treat the advisory as a tactical threat assessment rather than an attribution of specific incidents to specific platforms.

AI tools in the broader financial threat landscape

CERT-In’s warning aligns with a wider trend seen in prior reporting: adversaries increasingly use AI-driven tooling to accelerate discovery and exploitation.

In October, cybersecurity firm CrowdStrike reported that an unidentified attacker used ARTEX—another AI penetration-testing tool also referenced in CERT-In’s earlier advisory—along with Claude Code and other AI models to breach South Korean financial firms and steal data. Earlier coverage from Cointelegraph also highlighted concerns from security practitioners that defenders may lag behind attackers unless they can access equally capable AI-assisted security tooling.

For builders and security teams, the practical implication is straightforward: AI adoption is now part of both offensive and defensive workflows. CERT-In’s advisory suggests that simply performing one-time remediation may not be enough if attacker tactics keep changing, especially when timing is coordinated around human resource coverage gaps.

CERT-In’s recommendations were aimed at operational resilience. The agency advised organizations to treat the campaign as “active and escalating” and urged heightened security monitoring around the clock. It also called for increased staffing and lowered alert thresholds during weekends, holidays, and other low-coverage windows.

Cointelegraph reached out to CERT-In and several crypto companies mentioned in earlier reporting for comment, including CoinDCX, CoinSwitch, WazirX, ZebPay, and Mudrex, though the advisory itself did not provide additional public findings or confirmed targets.

Going forward, exchanges and other crypto-facing finance providers should watch for further guidance from CERT-In, especially any follow-up that identifies additional affected entities or clarifies which controls are most effective against “API-invocation” style compromises and wallet-key theft. Until then, the key uncertainty is scale—how many incidents occurred and where the weakest links are—alongside the speed at which CRAFTY FALCON adapts after organizations respond.