India's CERT-In warns AI-boosted CRAFTY FALCON is draining crypto wallets

India's Computer Emergency Response Team dropped the name on Wednesday: CRAFTY FALCON. In an update to a campaign it first flagged in October, the agency says the AI-assisted crew has widened its hunting ground, and crypto exchanges are now explicitly on the list. Wallet keys are getting stolen, and funds are getting drained.

CERT-In isn't soft-pedaling it. The agency says CSIRT-Fin keeps fielding reports of successful hits, including from nonbank lenders and fintechs that had already received the earlier restricted advisories and done remediation work. In its own words, the threat is active and ongoing.

The playbook is slick. Attackers scan targets with machine intelligence, move at machine speed, and strike by calling the victim's own payment and disbursement APIs, according to CERT-In. They slip in through vulnerable apps and exposed testing environments, ride shared credentials and access tokens into production systems, and plant malicious files in cloud infrastructure.

AI does the heavy lifting on the offensive side. CERT-In says the tools help attackers churn out and sharpen attack scripts fast, while the crew reverse-engineers application code to build custom exploits. Some raids land on weekends and holidays, when detection lags. In some cases, small test transfers come first to check the plumbing before bigger sums move.

The trail isn't new. In October, CrowdStrike reported an unidentified attacker used the AI penetration-testing tool ARTEX, which also shows up in CERT-In's advisory, alongside Claude Code and other AI models to breach South Korean financial firms and steal data. CERT-In didn't name any affected crypto exchanges or put a number on losses. Cointelegraph says it reached out to CERT-In, CoinDCX, CoinSwitch, WazirX, ZebPay and Mudrex for comment.

The agency's ask: treat this as active and escalating. At-risk firms are told to keep security monitoring running around the clock, add staff and lower alert thresholds during holidays, weekends and other thin-coverage windows. Solana Foundation CISO Michael Coates told Cointelegraph that defenders need the strongest AI models available, because attackers will have something capable enough. TRM Labs policy head Ari Redbord said in July that attack techniques outrun any single launch-day audit, and continuous security reviews are the only way to keep up.