India Warns: AI-Powered Hackers Target Crypto Exchanges and Fintechs
India's national cybersecurity agency CERT-In has issued a critical warning about a hacker group that uses AI tools to attack crypto exchanges, payment providers and digital lenders. According to the advisory of 4 November 2026, the group – dubbed "CRAFTY FALCON" – has stolen wallet keys and drained funds from crypto wallets. The campaign is still active.
How the attackers operate
- AI tools: The group uses publicly available AI-based security tools that run attack chains largely on their own, write custom scripts and adapt them to the target's responses.
- Test systems as the way in: Attackers enter through poorly secured test and staging environments that are reachable from the internet, then move into live systems via shared passwords or access tokens.
- Cloud and payment interfaces: They abuse cloud management services and payment APIs to trigger transfers.
- Small test payments: Before larger thefts, they send tiny amounts – sometimes just one rupee – to check that the unauthorised transfers work.
- Weekends and holidays: Attacks are often timed for when fewer staff are monitoring systems.
CERT-In says some companies were hit again after an earlier warning in October because they had not fully closed the gaps. The agency has not named any affected exchanges or published loss figures.
What exchanges are told to do
CERT-In recommends that crypto exchanges keep wallet keys in hardware security modules or cold storage, require several approvals (multisig) for withdrawals, watch for unusual withdrawal patterns and immediately replace keys if a compromise is suspected.
What this means for you
The attacks target the companies, not individual users directly. But anyone who keeps coins on an exchange carries the risk if the exchange is hacked. That is why it makes sense to:
- keep only what you need for trading on an exchange, and hold larger amounts in your own wallet,
- protect your exchange account with two-factor authentication via an app and a whitelist for withdrawal addresses,
- be wary of messages about "security incidents" asking you to move funds – criminals often exploit such news for phishing.
Even large platforms are not immune: our report on the Coinbase data breach shows how attackers exploit weak points at service providers.
Why this matters
AI tools make attacks faster and cheaper. What used to take skilled hackers days can now be partly automated. For crypto platforms, this means that basic security – separate test systems, protected keys, round-the-clock monitoring – is becoming even more important.
Sources
