CERT-In says CRAFTY FALCON is stepping up AI-assisted attacks on crypto exchanges

In short

• CERT-In named an AI-assisted group, CRAFTY FALCON, in a 4 November 2026 advisory on attacks against crypto exchanges and financial firms.
• CERT-In said attackers steal wallet private keys and drain funds, and that the campaign is still active.
• Some non-bank lenders and fintechs that fixed flaws after an October warning were attacked again, CERT-In said.
• CERT-In named no exchange and gave no loss figure; no Indian exchange has confirmed being targeted.

India's national cybersecurity agency says an AI-assisted hacking group it calls CRAFTY FALCON has stepped up attacks on cryptocurrency exchanges and financial firms, stealing wallet private keys and draining funds. The Indian Computer Emergency Response Team, or CERT-In, named the threat actor in an advisory issued on 4 November 2026, and said the attacks were ongoing.

CERT-In is the government body that handles cybersecurity incidents in India. Its finance-sector arm, CSIRT-Fin, issued the 4 November advisory as an update to an earlier warning on 9 October, according to Deccan Chronicle. The earlier notice did not single out crypto exchanges. The new one does, and it gives more detail on how AI tools are being used.

What CERT-In's CRAFTY FALCON advisory says

The campaign goes beyond crypto. According to India Today, CERT-In's list of targets covered digital lending platforms and non-banking financial companies, plus payment aggregators, fintech firms, payment service providers, virtual digital asset service providers and cryptocurrency exchanges. The agency said the threat remained active and ongoing, and that CSIRT-Fin was still receiving reports of successful attacks.

The most uncomfortable detail is that some firms were hit twice. According to India Today, CERT-In said it had received reports of successful attacks at non-bank financial companies and fintech firms that had already received the earlier restricted advisories and carried out fixes. Some were attacked again because they had not closed the flaws that first exposed them. Attackers also timed strikes for weekends and holidays, when security teams are thinner.

Why patched firms were hit again

The attack toolkit is openly available. Hindustan Times reported that CERT-In identified the CyberStrikeAI framework, the Cairn attack search engine, PentAGI, an autonomous multi-agent penetration testing system, and ARTEX among the tools used. The agency said they can produce many tailored attack scripts, alter their methods as a target responds, and complete several stages with limited human input. India Today reported that small-value transfers, including Re 1 tests, were used to see whether unauthorised payments would work before larger sums were tried.

A separate advisory on 3 November, from CERT-In and the Indian Cyber Crime Coordination Centre's threat analysis unit, described the money side of the campaign. Attackers break into badly patched or misconfigured internet-facing servers, then abuse automated fund-disbursement systems and payment APIs, the interfaces that let software move money. Cash goes to mule accounts, bank accounts used to pass stolen money on, and is quickly moved or withdrawn through IMPS and NEFT, Hindustan Times reported. Attackers also delete records to slow investigations.

CERT-In did not name any organisation that was attacked, and it gave no figure for the financial impact so far, according to India Today. That means there is no confirmed public evidence that a particular Indian exchange was breached in this campaign.

The agency's advice to financial firms is blunt. It asked for round-the-clock monitoring and more staff, tighter controls on cloud management tools and internet-facing systems, daily and per-transaction payment limits, checks on beneficiary details, cooling-off periods for new beneficiaries, and monitoring of unauthorised AI security tools and large language model API use. It also told firms to assume attackers may already be inside their networks.

What does this mean for Indian crypto traders?

If you hold crypto on an Indian exchange, nothing in the advisories says your account or funds have been affected. No exchange has been named or has confirmed being targeted in this campaign. What you can do is check your exchange's own security notices and any message it sends about the advisory, and treat unexpected emails, links or job-interview invitations asking for logins or wallet details with suspicion. The risk CERT-In describes is specific: stolen wallet keys and unauthorised transfers, including at firms that had already fixed earlier flaws.

🚨 ALERT: India’s CERT-In warns an AI-assisted hacker group dubbed “CRAFTY FALCON” has stepped up attacks on crypto exchanges and fintech firms to steal wallet keys and drain funds.https://t.co/nDGFa7hXYQ

AI that helps steal wallet keys scales faster than any bank SOC. Are exchange hot wallets even defensible?

for the record this falcon only reads charts 🦅 but ai assisted key theft hitting exchanges right after a 6.3b hack says the same thing twice. hot wallets are the target, cold storage is the product

The wallet key is now the target, not just the platform. If your keys sit where a phishing link can reach them, convenience is doing the attacker's job. Cold storage and a second check before any transfer are boring, and still undefeated.

How traders reacted on X

Cointelegraph's alert post drew about 155 likes and 46 replies, many of them about where keys live. Lars (@1864lars) said on X that AI-assisted key theft can scale faster than a bank's security operations centre and asked whether exchange hot wallets are defensible at all. MrFalcon (@Mr_falconx) said on X that hot wallets are the target and cold storage is the product. THEO (@timecommuter) said on X that the wallet key, not just the platform, is now the target, and backed cold storage plus a second check before any transfer.

How Indian traders reacted on X

Others focused on the firms. VIEH Group (@viehgroup) wrote on X that Indian exchanges and fintechs should establish where signing keys are stored, who can access those machines, and whether withdrawals require multiple approvals. Akshay (@iiam_Akshay) said on X that a single stolen key can still erase years of savings. Mozarch Btw (@mozarchbtw) argued on X that it was a scammer group relying on social engineering, not a hacker group.

What CERT-In asked firms to do next

CERT-In has asked financial institutions to tighten controls and keep monitoring. Whether any Indian exchange or fintech firm comes forward to confirm an attack, and whether the agency publishes further updates, is still open.

Timeline

• 9 Oct 2026: CERT-In issues an earlier warning on the attack campaign
• 3 Nov 2026: CERT-In and I4C flag AI-driven attacks and unauthorised fund transfers
• 4 Nov 2026: CERT-In names CRAFTY FALCON and cites crypto exchanges as targets

Questions readers ask

Has CERT-In named any Indian crypto exchange as hacked?

No. CERT-In did not name any organisation that was attacked in its 4 November 2026 advisory, and it gave no figure for the financial impact so far, according to India Today. No Indian exchange has publicly confirmed being targeted in the CRAFTY FALCON campaign. The advisory names sectors, including cryptocurrency exchanges and virtual digital asset service providers, not individual firms.

What should users of Indian crypto exchanges check after the CERT-In warning?

Nothing in the CERT-In advisories says customer accounts or funds at Indian exchanges have been affected, and no exchange has been named. Users can check their exchange's own security notices and any message it sends about the advisory. CERT-In's described risk is stolen wallet keys and unauthorised transfers, including at firms that had already fixed earlier flaws.

What AI tools is CRAFTY FALCON using, according to CERT-In?

CERT-In named ARTEX, the PentAGI multi-agent penetration testing system, the Cairn attack search engine and the CyberStrikeAI framework, Hindustan Times reported. The agency said these publicly available tools can write many custom attack scripts, adapt as a target responds, and run several stages of an attack with little human involvement. Attackers also used Re 1 test transfers before larger ones, India Today reported.

Our view

At InvestIn.News, we think the important part of CERT-In's advisory is not the label "AI hackers" but the two facts underneath it: the agency named the group, and it named crypto exchanges as targets.

Naming CRAFTY FALCON turns a vague warning into something exchanges can hunt for. It also puts crypto venues in the same bracket as banks and payment firms, which is where Indian exchanges now sit whether or not they like the comparison.

The detail that should worry the industry is that non-bank lenders and fintechs which had already fixed flaws after the October warning were reported hit again. A patched server is not the same as a protected wallet key or payment pipe, and CERT-In's own advice, from multi-approval withdrawals to cooling-off periods for new beneficiaries, points at controls rather than patches.

We would change this view if an Indian exchange confirms an incident and shows what it fixed, or if CERT-In publishes a further update with named victims or losses.

How we reported this: this story draws on reporting by X, Hindustan Times, Deccan Chronicle, India Today and cointelegraph.com and 8 public posts shown in the story. Each source is linked in the text and listed under Sources.

Follow the latest on AI NewsFeeds for short updates as the news breaks.

Keshav Aggarwal

What to watch: CERT-In has asked financial firms to tighten controls and keep monitoring; no Indian exchange has yet confirmed being targeted.