India cybersecurity agency flags AI-assisted attacks on crypto exchanges

Traders Union
All News
Crypto
India flags AI crypto attacks

Highlights

CERT-In updated its warning on the active CRAFTY FALCON campaign, citing continued AI-assisted attacks on nonbank lenders, fintechs, payment aggregators, and crypto exchanges.
The attackers exploit vulnerabilities using machine intelligence and AI tools to rapidly generate scripts, breach environments, steal crypto wallet keys, and time intrusions during weekends and holidays.
CERT-In urges financial firms and exchanges to heighten real-time monitoring and lower detection thresholds, highlighting escalating threats from advanced AI-powered intrusion techniques.

Expanded warning on active campaign

As reported by Cointelegraph, citing CERT-In, the Indian Computer Emergency Response Team has updated a campaign it first warned about in October and now designates the threat actor as CRAFTY FALCON. The agency says the operation remains active and ongoing, with CSIRT-Fin continuing to receive reports of successful attacks, including from non-banking financial companies and fintech entities that had already received earlier restricted advisories and taken remediation steps.

The campaign has targeted nonbank lenders, digital lending platforms, fintech companies, payment aggregators and service providers, as well as crypto exchanges. CERT-In says the attackers exploit vulnerable applications and exposed testing environments, then use shared credentials and access tokens to move into production systems, while also targeting cloud infrastructure to deploy malicious files.

CERT-In says the threat actor surveys targets with machine intelligence, operates at machine speed and invokes victims' own payment and disbursement APIs to strike. The advisory adds that AI tools help the attackers quickly generate and refine scripts, reverse-engineer application code for tailored exploits and time some intrusions for weekends and holidays to delay detection.

Pressure grows on financial and crypto defenses

In some incidents, the attackers use small test transactions to validate unauthorized transfers before attempting larger movements of money. CERT-In also reports stolen cryptocurrency wallet keys and funds drained from wallets, although it does not name affected exchanges or quantify losses.

The warning adds to broader signs that AI-enabled intrusion tools are being used against financial institutions. In October, CrowdStrike reported that an unidentified attacker used the AI penetration-testing tool ARTEX, which is also named in CERT-In's advisory, alongside Claude Code and other AI models to breach South Korean financial firms and steal data.

CERT-In advises companies to treat the campaign as active and escalating, increase security monitoring around the clock and lower alert thresholds during holidays, weekends and other low-coverage periods. Security executives cited in the wider debate over AI threats have argued that defenders need access to strong AI models and continuous reviews because attack techniques are evolving faster than one-time audits can address.

Banks need “bare metal” recovery planning as AI increases the scale and complexity of cyber threats to financial systems, our earlier article noted. It explained the Bank of England’s push for independent, end-to-end recovery options that can keep critical services running even if primary technology is compromised, alongside calls for stronger cyber hygiene and resilience to reduce systemic risk.

This material may contain third-party opinions, none of the data and information on this webpage constitutes investment advice according to our Disclaimer. While we adhere to strict Editorial Integrity, this post may contain references to products from our partners.