CERT-In says CRAFTY FALCON hackers use AI to target crypto exchanges

Key points

• The agency says attackers exploited vulnerable applications, exposed testing environments and shared credentials to reach production systems.
• CERT-In reported stolen crypto wallet keys and funds drained from wallets, without naming exchanges or quantifying losses.

India's cyber agency says CRAFTY FALCON, an AI-assisted hacking group, is escalating attacks on crypto exchanges and other financial businesses. The Indian Computer Emergency Response Team (CERT-In) named the threat actor on 4 November in an update to a campaign it first flagged in October, according to Cointelegraph. The advisory now explicitly lists crypto exchanges among affected businesses and sets out how AI tools are used in the attacks.

CERT-In said the group surveys targets with machine intelligence, works at machine speed and strikes by calling victims' own payment and disbursement APIs. It has also targeted nonbank lenders, digital lending platforms, fintech firms, payment aggregators and service providers.

AI tools helped the attackers generate and refine attack scripts quickly and reverse-engineer application code for tailored exploits, CERT-In reported. The agency reported stolen wallet keys and funds drained from wallets, but did not name affected exchanges or give loss figures.

CERT-In said the threat is active and ongoing, with its financial sector team still receiving reports of successful attacks, including from firms that had acted on earlier restricted advisories. It urged at-risk companies to treat the campaign as escalating, with round-the-clock monitoring and lower alert thresholds during holidays and weekends.

What to watch: CERT-In has asked at-risk firms to treat the campaign as active and escalating and to tighten monitoring; Cointelegraph is awaiting comment from the exchanges it contacted.

Read the full story on Cointelegraph →