TLDR
- India’s CERT-In named an AI-assisted hacking group “CRAFTY FALCON” in an updated advisory.
- Crypto exchanges are now officially listed among the targets, along with lenders and fintech firms.
- Attackers stole crypto wallet keys and drained funds using victims’ own payment systems.
- Some firms that had already fixed their systems after earlier warnings were still breached.
- CERT-In did not name any affected exchanges or say how much money was lost.
India’s national cybersecurity agency says an AI-assisted hacking group is timing some of its attacks for weekends and holidays, when fewer staff are watching. The group has stolen crypto wallet keys and drained funds from financial firms, including crypto exchanges.
The Indian Computer Emergency Response Team, known as CERT-In, named the threat actor “CRAFTY FALCON” on Wednesday. The advisory updates a campaign the agency first warned about in October.
The new advisory is the first to name crypto exchanges among the affected businesses. It also describes how the group uses AI attack tools.
CERT-In said the threat is “active and ongoing.” It added that CSIRT-Fin, the financial sector response team, keeps receiving reports of successful attacks.
Some of those reports came from nonbank lenders and fintech firms that had already received earlier restricted warnings. These companies had taken steps to fix their systems but were still hit.
How the Attacks Work
CERT-In said the group “surveys its targets with machine intelligence, operates at machine speed and strikes by invoking the victim’s own payment and disbursement APIs.” In simple terms, the attackers use a company’s own payment systems to move money out.
The campaign has hit nonbank lenders, digital lending platforms, fintech companies, payment aggregators and service providers. Crypto exchanges are also on the list.
Attackers broke in through weak applications and exposed testing environments. They then used shared login details and access tokens to reach live production systems.
The group also went after cloud infrastructure to plant malicious files. AI tools helped them quickly write and improve attack scripts.
The attackers reverse-engineered application code to build exploits made for each target. Some attacks were set for weekends and holidays to slow down detection.
In some cases, the hackers sent small test transactions first. Once those went through, they moved larger amounts.
CERT-In did not name any affected crypto exchanges. It also did not say how much money was lost.
Cointelegraph contacted CERT-In, CoinDCX, CoinSwitch, WazirX, ZebPay and Mudrex for comment.
AI Tools Linked to Earlier Attacks
The advisory names ARTEX, an AI penetration-testing tool. In October, CrowdStrike reported that an unknown attacker used ARTEX, along with Claude Code and other AI models, to break into South Korean financial firms and steal data.
Solana Foundation chief information security officer Michael Coates has said defenders need access to the strongest AI tools.
“We need to make sure that the best models we can get are in the hands of defenders because attackers will have something capable enough,” he told Cointelegraph.
TRM Labs head of policy Ari Redbord told Cointelegraph in July that “attack techniques are moving faster than a single audit from launch day can account for.” He called for ongoing security reviews.
CERT-In has told firms to “treat this campaign as active and escalating.” It urged companies at risk to monitor security around the clock, add more staff and lower alert thresholds during holidays, weekends and other low-coverage periods.
