CERT-In sounds the alarm as AI-powered hackers turn crypto exchanges into machine-speed targets

India’s national cybersecurity agency has identified crypto exchanges among the targets of an active AI-assisted threat actor, warning that the campaign is escalating and operating at “machine speed.” The Indian Computer Emergency Response Team (CERT-In) designated the actor “CRAFTY FALCON” in a Wednesday update to a threat first reported in October.

“The threat is active and ongoing. CSIRT-Fin continues to receive reports of successful attacks, including from NBFCs and fintech entities that had already received the earlier restricted advisories and had undertaken remediation,” CERT-In said. The campaign has targeted crypto exchanges, nonbank lenders, digital lending platforms, fintech companies, payment aggregators and service providers.

Attackers exploited vulnerable applications and exposed testing environments, using shared credentials and access tokens to reach production systems. They also targeted cloud infrastructure to deploy malicious files, reverse-engineered application code to create tailored exploits and used AI tools to generate and refine attack scripts. Some attacks were scheduled for weekends and holidays to delay detection, while small test transactions were used to validate unauthorized transfers before larger sums were moved. CERT-In also reported stolen cryptocurrency wallet keys and funds drained from wallets, but did not identify any affected crypto exchanges or quantify losses.

CERT-In’s advisory follows a CrowdStrike report in October that an unidentified attacker used ARTEX, an AI penetration-testing tool also named in the advisory, alongside Claude Code and other AI models to breach South Korean financial firms and steal data. Cointelegraph sought comment from CERT-In, CoinDCX, CoinSwitch, WazirX, ZebPay and Mudrex. CERT-In advised organizations to “treat this campaign as active and escalating,” increase round-the-clock monitoring, add staffing and lower alert thresholds during holidays, weekends and other low-coverage periods.