---
title: "India's CERT-In Warns Crypto Exchanges of AI-Driven 'CRAFTY FALCON' Cyberattacks"
description: "Cybersecurity agency CERT-In reports attackers are operating at machine speed to siphon digital assets and compromise payment APIs."
url: https://basisdesk.news/news/cert-in-warns-crypto-exchanges-ai-crafty-falcon
published: 2026-11-05T02:22:14.757Z
modified: 2026-11-05T02:22:14.757Z
section: Security & Hacks
author: Basis Desk Newsroom (AI-generated, source-verified)
sentiment: bearish
tickers: [BTC, ETH]
tags: [cybersecurity, india, cert-in, exchanges, artificial-intelligence, exploits]
license: Quote with attribution to Basis Desk (basisdesk.news). Not financial advice.
---

# India's CERT-In Warns Crypto Exchanges of AI-Driven 'CRAFTY FALCON' Cyberattacks

Cybersecurity agency CERT-In reports attackers are operating at machine speed to siphon digital assets and compromise payment APIs.

## At a glance

- **What happened:** India's cybersecurity agency CERT-In warned that AI-assisted actor CRAFTY FALCON is actively targeting cryptocurrency exchanges and stealing wallet keys.
- **Why it matters:** The campaign uses automated tools to reverse-engineer code and invoke victim APIs at machine speed, bypassing traditional periodic security checks.
- **Who is affected:** Cryptocurrency exchanges, digital lending platforms, payment aggregators, and fintech entities operating in or connected to India.
- **What's next:** Affected firms must implement continuous 24/7 security monitoring and adjust threshold alerts across off-hours and holiday windows.
- **Status:** guidance
- **Primary source:** [India warns AI-powered hackers targeting crypto exchanges at ‘machine speed’](https://cointelegraph.com/news/india-warns-ai-powered-hackers-targeting-crypto-exchanges-at-machine-speed?utm_source=rss_feed&utm_medium=rss&utm_campaign=rss_partner_inbound) — cointelegraph.com

## Key points

- CERT-In designated an AI-assisted threat actor dubbed 'CRAFTY FALCON' targeting crypto exchanges and fintech firms.
- The attackers use automated penetration-testing tools, including ARTEX, to reverse-engineer code and execute payment API exploits.
- CERT-In confirmed instances of stolen cryptocurrency wallet keys and drained balances, but did not name the affected exchanges.

## Editorial remark

- **Context:** CERT-In first warned financial firms about the campaign in October before upgrading the alert to explicitly include digital asset platforms following confirmed key thefts.
- **Impact:** Exchanges and nonbank financial firms face increased vulnerability to machine-speed intrusions, forcing teams to lower alert thresholds and bolster off-hours coverage.
- **Watch:** Whether Indian exchanges report formal disclosures of compromised balances or if CERT-In provides specific loss estimates tied to the campaign.

India's national cybersecurity agency, the Indian Computer Emergency Response Team (CERT-In), has issued an advisory warning that an artificial-intelligence-assisted threat actor is targeting cryptocurrency exchanges and broader financial service providers [1]. Designated by the agency as "CRAFTY FALCON," the ongoing campaign involves the theft of cryptocurrency wallet keys and the siphoning of customer and institutional funds [1]. The update follows an initial advisory circulated in October, now expanded to explicitly name cryptocurrency platforms alongside nonbank lenders, fintech platforms, and payment aggregators [1].

According to CERT-In, the threat actor operates at "machine speed," surveying victim infrastructure with machine intelligence and deploying attacks via the victims' own disbursement and payment application programming interfaces (APIs) [1]. Attackers leveraged testing environments, vulnerable software applications, exposed credentials, and compromised cloud systems to pivot directly into live production networks [1]. CERT-In noted that the group utilizes automated AI tools to engineer custom exploit scripts, reverse-engineer proprietary application code, and run low-value test transfers before draining larger balances [1].

## Automated Offense Strains Financial Defenses

The exploitation mirrors broader industry warnings that adversarial automation is outpacing traditional perimeter defense models. In October, cybersecurity firm CrowdStrike recorded incidents where attackers combined the AI penetration-testing tool ARTEX alongside frontier models such as Claude Code to breach South Korean financial institutions [1]. CERT-In reported that CRAFTY FALCON similarly deploys ARTEX to accelerate attack iterations, frequently scheduling operations during weekends and statutory holidays to deliberately delay detection [1]. Security leaders, including the founder of Swan Bitcoin, have previously argued that [AI poses a greater threat to ecosystem infrastructure than emerging quantum computing](https://basisdesk.news/news/swan-founder-ai-poses-greater-threat-than-quantum) models.

CERT-In advised targeted organizations to regard the threat as escalating and urged round-the-clock defensive monitoring, enhanced off-hours staffing, and tightened incident alert thresholds [1]. The agency did not publicly identify specific impacted cryptocurrency exchanges or disclose total financial losses [1]. The warning comes as broader crypto markets traded steadily, with $BTC changing hands around $80,620 and $ETH at $2,427 at the time of writing.

## Sources

1. [India warns AI-powered hackers targeting crypto exchanges at ‘machine speed’](https://cointelegraph.com/news/india-warns-ai-powered-hackers-targeting-crypto-exchanges-at-machine-speed?utm_source=rss_feed&utm_medium=rss&utm_campaign=rss_partner_inbound) — cointelegraph.com, 2026-11-05

---
Basis Desk Newsroom · AI-generated, source-verified · https://basisdesk.news/about/how-we-use-ai