India's CERT-In Warns AI-Powered 'CRAFTY FALCON' Hackers Targeting Crypto Exchanges at Machine Speed

India's Computer Emergency Response Team (CERT-In) on Wednesday escalated its advisory on an AI-assisted threat actor designated "CRAFTY FALCON," explicitly adding cryptocurrency exchanges to a target list that already included non-bank financial companies (NBFCs), digital lending platforms, fintech firms, payment aggregators, and service providers. The update marks the first time the agency has publicly identified crypto exchanges among the affected entities in a campaign it first warned about in October.

Key Takeaways

CERT-In escalated advisory on 'CRAFTY FALCON' threat actor, explicitly naming crypto exchanges as targets alongside NBFCs and fintechs
AI tools (ARTEX, Claude Code) enable automated reconnaissance, exploit generation, and API-driven fund extraction at 'machine speed'
Attacks exploit testing environments, shared credentials, and cloud infrastructure; timed for weekends/holidays to evade detection
CSIRT-Fin confirms ongoing successful breaches even after prior remediation efforts, indicating adaptive threat methodology
No affected exchanges named or losses quantified; CERT-In mandates 24/7 monitoring with lowered alert thresholds

INTELLIGENCE

Executive Intelligence Brief

What Happened: India's Computer Emergency Response Team (CERT-In) escalated its advisory on an AI-assisted threat actor designated 'CRAFTY FALCON,' explicitly identifying cryptocurrency exchanges as targets alongside non-bank lenders, fintechs, and payment aggregators. The agency confirmed ongoing successful attacks involving theft of wallet keys and unauthorized fund transfers executed at 'machine speed' via compromised payment APIs.

Why It Matters: The advisory signals a structural shift in cyber risk for digital asset platforms: AI tooling now automates reconnaissance, exploit generation, and execution at speeds that outpace traditional periodic audits and human-led monitoring, particularly during low-coverage windows. This raises immediate operational resilience questions for exchanges, custodians, and regulators globally.

What to Watch: CERT-In urges 24/7 heightened monitoring with lowered alert thresholds during weekends and holidays; affected entities must validate remediation of exposed testing environments and shared credentials; global regulators may issue coordinated guidance on AI-driven threat modeling; monitor for exchange-specific breach disclosures and potential regulatory capital or insurance implications.

AI Tooling Accelerates Attack Lifecycle

According to CERT-In, the threat actor "surveys its targets with machine intelligence, operates at machine speed and strikes by invoking the victim's own payment and disbursement APIs." Attackers leverage AI tools — including ARTEX, an AI penetration-testing framework also cited by CrowdStrike in October attacks on South Korean financial firms, and Claude Code — to rapidly generate and refine attack scripts, reverse-engineer application code for tailored exploits, and automate lateral movement.

The campaign exploits vulnerable applications, exposed testing environments, shared credentials, and access tokens to breach production systems. Cloud infrastructure is targeted for malicious file deployment. In multiple incidents, attackers executed small test transactions to validate unauthorized transfer paths before draining larger sums, with wallet keys stolen and funds removed.

Weekend and Holiday Timing Exploits Coverage Gaps

CERT-In noted that some attacks were deliberately timed for weekends and holidays to delay detection, a tactic that directly challenges standard security operations center (SOC) staffing models. The agency's financial sector incident response team (CSIRT-Fin) reported that successful breaches continue even among entities that received earlier restricted advisories and undertook remediation, indicating either incomplete mitigation or adaptive attacker methodology.

"The threat is active and ongoing. CSIRT-Fin continues to receive reports of successful attacks, including from NBFCs and fintech entities that had already received the earlier restricted advisories and had undertaken remediation," CERT-In stated.

Defensive AI Arms Race Intensifies

The advisory underscores a growing asymmetry: offensive AI capabilities are commoditizing sophisticated attack chains, while defensive teams struggle to match velocity. Solana Foundation CISO Michael Coates previously told Cointelegraph that "we need to make sure that the best models we can get are in the hands of defenders because attackers will have something capable enough." TRM Labs head of policy Ari Redbord added that "attack techniques are moving faster than a single audit from launch day can account for," urging continuous security reviews over point-in-time assessments.

Regulatory and Operational Implications

CERT-In has advised all at-risk entities to "treat this campaign as active and escalating," mandating 24/7 heightened security monitoring, increased staffing, and lowered alert thresholds during low-coverage windows. The agency did not name specific affected exchanges or quantify total losses. Cointelegraph requested comment from major Indian platforms including CoinDCX, CoinSwitch, WazirX, ZebPay, and Mudrex.

The warning arrives amid a string of high-profile crypto breaches, including the Binance-linked exploit where hackers moved 81% of stolen Solana via THORChain, and a $6.3 billion hack traced to compromised AI tools and fake job interviews. These incidents collectively signal that AI-augmented threat actors are now a persistent, structural feature of the digital asset risk landscape.