India CERT-In Warns AI Hackers Targeting Crypto Exchanges

By Nodora News · 5 November 2026

India's CERT-In warns that AI-assisted hackers dubbed CRAFTY FALCON are targeting crypto exchanges at machine speed and stealing wallet keys.

India's national cybersecurity agency has warned that an AI-assisted threat actor is escalating attacks on cryptocurrency exchanges and other financial firms, stealing wallet keys and moving money through the victims' own payment systems. In an updated advisory issued on Wednesday, November 4, 2026, and widely reported on Thursday, November 5, the Indian Computer Emergency Response Team (CERT-In) and its finance unit CSIRT-Fin named the campaign CRAFTY FALCON. The notice builds on an October 9 advisory about attackers abusing payment and disbursement APIs across banking, financial services and insurance (BFSI) entities.

Key takeaways

• CERT-In says CRAFTY FALCON surveys targets with machine intelligence, operates at machine speed and strikes by invoking victims' own payment and disbursement APIs.
• Affected categories now explicitly include cryptocurrency exchanges and virtual digital asset (VDA) service providers, alongside NBFCs, fintechs, lenders and payment firms.
• Attackers are using publicly available AI offensive tools, including the LLM-based ARTEX family, the autonomous multi-agent system PentAGI, the Cairn attack search engine and the CyberStrikeAI framework.
• Entry points include exposed test and staging environments, shared credentials and cloud services such as AWS Systems Manager (SSM) and Lambda; stolen crypto wallet keys and drained funds have been reported.
• The agency did not name any exchanges or publish loss totals, and it advises 24/7 monitoring, extra staffing and lower alert thresholds on weekends and holidays.

What CERT-In says CRAFTY FALCON is doing

CERT-In describes CRAFTY FALCON as an AI-assisted financial threat actor that can run complete attack chains with little human delay. According to the advisory, the group reverse-engineers application code, generates and refines large volumes of tailored scripts, and adapts payloads as systems respond. That pace is why the agency keeps returning to the phrase "machine speed."

The campaign is not a single one-day breach. CSIRT-Fin says it continues to receive reports of successful attacks, including from firms that already received earlier restricted advisories and tried to remediate. In several cases, entities were deliberately re-targeted after incomplete fixes. Timing also matters: some activity has been aligned with weekends, holidays and other low-coverage windows so that detection and response arrive late.

How attackers reach crypto exchanges and drain wallets

CERT-In says attackers often start where controls are weaker than production: exposed test or staging systems, shared credentials and access tokens that then open a path into live environments. Cloud infrastructure is another vector, with malicious files and tooling deployed through services such as AWS SSM and Lambda once access is gained.

Once inside payment or disbursement flows, the pattern can look almost routine. Attackers have used very small Re 1 or other micro-value test transfers to confirm that unauthorized payouts work, then followed with larger transfers. On the crypto side, the advisory cites stolen cryptocurrency wallet keys and funds drained from wallets. No Indian exchange was named in the public reporting, and no aggregate loss figure was provided.

The same week has already underscored how AI tooling is reshaping crypto security more broadly. Nodora covered how GitBook said an AI-agent attack forced crypto docs teams to rotate tokens, and how Binance traced its record $6.3 billion hack to a fake job interview that later involved an internal AI tool.

AI tools named in the advisory, and the CrowdStrike parallel

CERT-In lists several publicly available AI-driven offensive security tools in the CRAFTY FALCON toolkit. ARTEX is described as an LLM-based family of tools. PentAGI is framed as an autonomous multi-agent penetration testing system. Cairn is cited as an attack search engine, and CyberStrikeAI as a broader offensive framework. Together, the agency says, these systems can execute attack chains autonomously, spawn many tailored scripts quickly and adjust based on how a target answers.

That warning sits alongside separate industry reporting. In October, CrowdStrike said an unidentified attacker used ARTEX together with Claude Code and other AI models against South Korean financial firms to steal data. CERT-In does not claim CRAFTY FALCON was behind those South Korean incidents, but the overlap on ARTEX underlines how the same class of public AI offensive tooling is showing up in financial cyber campaigns beyond India.

Bitcoin (BTC) market context and what exchanges are watching

The CERT-In update landed as Bitcoin (BTC) and Ether (ETH) were recovering on the day, according to OKX spot prices at the time of writing:

• Bitcoin (BTC): about $80,463, up roughly 4.8% over 24 hours
• Ether (ETH): about $2,421, up roughly 7.2% over 24 hours

Those moves reflect broader market conditions rather than a clear reaction to the Indian advisory itself. Still, exchange and VDA operators will be watching whether more jurisdictions publish similar AI-tool warnings, and whether on-chain drain patterns tied to compromised payment APIs or wallet keys appear in public trackers. Live prices are available on the Nodora charts page.

What to watch next

• More victim reports: CSIRT-Fin says the campaign is active; further disclosures from NBFCs, fintechs or crypto venues would clarify scale.
• Named exchanges or loss totals: none have been published so far; any official tally would change the story.
• Holiday and weekend staffing: CERT-In is explicitly telling BFSI and VDA firms to lower alert thresholds and keep 24/7 cover when monitoring is thin.
• Defender AI access: security leaders argue legitimate teams need strong models too, because attackers already have capable public tools.

This article is for information only and is not financial advice.

#Bitcoin #CERT-In #Cybersecurity #India #Crypto Exchanges

This article is general information, not financial advice.