India's cyber watchdog flags AI hackers draining crypto wallets at machine speed

India's national cybersecurity agency says the hackers coming for crypto exchanges aren't just persistent — they're automated. In a Wednesday update to a campaign it first flagged in October, the Indian Computer Emergency Response Team (CERT-In) formally designated the threat actor as CRAFTY FALCON and, for the first time, named crypto exchanges among its targets. The advisory also spells out how heavily the group leans on AI attack tools.

CERT-In didn't soften the message: the threat is live and getting worse. CSIRT-Fin, its financial-sector arm, keeps fielding reports of successful attacks — including from nonbank finance companies and fintechs that had already received the earlier restricted advisories and done remediation work. The agency did not name any affected crypto exchanges or put a number on losses.

The playbook reads like a burglary crew that never sleeps. According to CERT-In, the attackers probe vulnerable applications and exposed testing environments, then ride shared credentials and access tokens into production systems. They hit cloud infrastructure to plant malicious files, use AI to rapidly generate and refine attack scripts, reverse-engineer application code for tailored exploits, and time strikes around weekends and holidays to buy extra hours before anyone notices.

The money moves in stages. In some incidents, attackers fired off small test transactions to confirm unauthorized transfers would clear before pushing through larger sums. CERT-In also reported stolen cryptocurrency wallet keys and funds siphoned straight out of wallets. The campaign's target list stretches across nonbank lenders, digital lending platforms, fintechs, payment aggregators and service providers — plus crypto exchanges.

This isn't an isolated data point. Cybersecurity firm CrowdStrike reported in October that an unidentified attacker used ARTEX, an AI penetration-testing tool also named in CERT-In's advisory, along with Claude Code and other AI models, to breach South Korean financial firms and walk off with data.

CERT-In's advice to at-risk companies: treat the campaign as active and escalating. That means round-the-clock security monitoring, more staff on deck, and lower alert thresholds during holidays, weekends and other low-coverage windows. Cointelegraph reached out to CERT-In, CoinDCX, CoinSwitch, WazirX, ZebPay and Mudrex for comment. Industry voices have been sounding the same alarm — Solana Foundation CISO Michael Coates has argued the strongest AI models need to be in defenders' hands, while TRM Labs policy head Ari Redbord warned that attack techniques now outpace any single audit conducted on launch day.