India flags AI-assisted crew CRAFTY FALCON as crypto exchange attacks surge

India's Computer Emergency Response Team designated an active threat actor as CRAFTY FALCON on Wednesday, naming cryptocurrency exchanges among the financial businesses it has been hitting. According to CERT-In, the group is AI-assisted and has been stealing wallet keys and siphoning funds. The agency says the campaign is far from over: CSIRT-Fin keeps receiving reports of successful attacks, including from non-banking finance companies and fintech firms that had already received earlier restricted advisories and done remediation work.

The Indian warning slots into a fast-growing pattern of hackers leaning on AI tools against financial targets. In October, CrowdStrike reported that an unidentified attacker used ARTEX, an AI penetration-testing tool also flagged in CERT-In's advisory, plus Claude Code and other AI models, to break into South Korean financial firms and walk off with data.

South Korea's Financial Services Commission isn't waiting around. It called an emergency meeting with regulators, cybersecurity agencies and crypto service providers after the $6.3 billion attack on Binance, and urged exchanges to raise the share of assets kept in offline cold wallets. It also reviewed IT access controls, wallet withdrawal approval and signing procedures, and admin privileges. The nudge is partly symbolic: South Korean law already demands at least 80% cold storage, with Upbit holding 99.17%, Bithumb 94.76% and Coinone 85%.

Seoul's central bank is stress-testing the what-ifs. The Bank of Korea is surveying 31 financial institutions on how a major exchange shutdown, a prolonged crypto downturn or losses at another firm could spill into their operations — including a scenario where the country's largest exchange by market share temporarily halts after a big hack. Meanwhile, Pyongyang is playing innocent on the Binance hit. Kim Yo Jong dismissed US claims of DPRK involvement as 'absurd rhetoric,' suggesting the Americans were behind it.

Elsewhere in the region, the regulatory screws and the exits keep coming. Crypto.com will shut its consumer app in Hong Kong on Feb. 1, 2027, while still chasing a full license for its institutional exchange — nearly three years after its local entity applied and stayed stuck in 'deemed-to-be-licensed' limbo. Thailand's SEC filed a criminal complaint against BG Limited, which runs Bitget, for allegedly operating without a license between 2022 and 2025, and will block the site and app from Dec. 5. Hong Kong expanded its Project Ensemble pilot to around-the-clock settlement of tokenized transactions, and five banking heavyweights — HSBC, JPMorgan's Kinexys, MUFG, Société Générale-Forge and Standard Chartered — launched the Global Layer One Organization in Singapore to push tokenized market standards.

Australia added its own twist. The Reserve Bank raised rates by 25 basis points, to 4.85%, in a 6–3 board vote, and pushed its forecast for inflation hitting the 2%–3% target band out to late 2027. The government's scrapping of the 50% capital gains discount has crypto holders reeling — Finder founder Fred Schebesta says he's moving to Singapore, calling the change a 'killer blow.'