India's CERT-In Warns Crypto Exchanges of AI-Driven 'CRAFTY FALCON' Cyberattacks
AI disclosure: drafted by Basis Desk's AI newsroom and machine-checked against the primary sources listed below — how we use AI. Originally published on Basis Desk.
Cybersecurity agency CERT-In reports attackers are operating at machine speed to siphon digital assets and compromise payment APIs.
Key points
- CERT-In designated an AI-assisted threat actor dubbed 'CRAFTY FALCON' targeting crypto exchanges and fintech firms.
- The attackers use automated penetration-testing tools, including ARTEX, to reverse-engineer code and execute payment API exploits.
- CERT-In confirmed instances of stolen cryptocurrency wallet keys and drained balances, but did not name the affected exchanges.
India's national cybersecurity agency, the Indian Computer Emergency Response Team (CERT-In), has issued an advisory warning that an artificial-intelligence-assisted threat actor is targeting cryptocurrency exchanges and broader financial service providers [1]. Designated by the agency as "CRAFTY FALCON," the ongoing campaign involves the theft of cryptocurrency wallet keys and the siphoning of customer and institutional funds [1]. The update follows an initial advisory circulated in October, now expanded to explicitly name cryptocurrency platforms alongside nonbank lenders, fintech platforms, and payment aggregators [1].
According to CERT-In, the threat actor operates at "machine speed," surveying victim infrastructure with machine intelligence and deploying attacks via the victims' own disbursement and payment application programming interfaces (APIs) [1]. Attackers leveraged testing environments, vulnerable software applications, exposed credentials, and compromised cloud systems to pivot directly into live production networks [1]. CERT-In noted that the group utilizes automated AI tools to engineer custom exploit scripts, reverse-engineer proprietary application code, and run low-value test transfers before draining larger balances [1].
Automated Offense Strains Financial Defenses
The exploitation mirrors broader industry warnings that adversarial automation is outpacing traditional perimeter defense models. In October, cybersecurity firm CrowdStrike recorded incidents where attackers combined the AI penetration-testing tool ARTEX alongside frontier models such as Claude Code to breach South Korean financial institutions [1]. CERT-In reported that CRAFTY FALCON similarly deploys ARTEX to accelerate attack iterations, frequently scheduling operations during weekends and statutory holidays to deliberately delay detection [1]. Security leaders, including the founder of Swan Bitcoin, have previously argued that AI poses a greater threat to ecosystem infrastructure than emerging quantum computing models.
CERT-In advised targeted organizations to regard the threat as escalating and urged round-the-clock defensive monitoring, enhanced off-hours staffing, and tightened incident alert thresholds [1]. The agency did not publicly identify specific impacted cryptocurrency exchanges or disclose total financial losses [1]. The warning comes as broader crypto markets traded steadily, with $BTC changing hands around $80,620 and $ETH at $2,427 at the time of writing.
Sources
- India warns AI-powered hackers targeting crypto exchanges at ‘machine speed’ — Primary document (discovered)
Basis Desk is a source-verified crypto newsroom. Market data, a free MCP server for AI agents and JSON APIs: basisdesk.news/developers. Not investment advice.