CERT-In Names CRAFTY FALCON in AI-Driven Crypto Exchange Key Theft

India's cyber watchdog has a name for the crew pulling keys out of crypto exchanges: CRAFTY FALCON. The Computer Emergency Response Team (CERT-In) says the actor is running an active, AI-assisted campaign that steals wallet keys and siphons funds straight out of wallets — not by cracking the crypto, but by walking through the front door.

The entry point is mundane. Attackers hit internet-exposed testing or staging systems first, then rode shared credentials, tokens and network paths into production. From there, per CERT-In, they reverse-engineered application code and tampered with packages to make unauthorized API calls against exchange infrastructure.

The tell is tiny. Attackers fired off Rs. 1 transactions to probe whether unauthorized fund flows would go unnoticed before scaling up to bigger transfers. The campaign also leaned on payment aggregators' merchant settlement APIs, widening the blast radius beyond exchanges.

Exchanges aren't the only ones in the crosshairs. CERT-In says it has fielded reports of fresh attacks on nonbank lenders and fintech firms that had already acted on earlier advisories — some got hit again because their remediation was incomplete. Notably, the agency did not flag crypto exchanges as repeat targets in that wave.

CERT-In's fix list is blunt: monitor around the clock, add staff, and drop alert thresholds during weekends, holidays and any stretch when coverage thins out. Attackers test in the quiet windows — so the quiet windows are where defenders need to hold the line.

Takeaway for the industry: the keys are the target, the test server is the door, and AI is speeding up the burglar. Whoever leaves staging environments exposed and remediation half-finished is volunteering as the next case study.