India warns of escalating AI-assisted attacks on crypto exchanges

The Indian Computer Emergency Response Team (CERT-In) warned that an AI-assisted threat actor has intensified attacks against cryptocurrency exchanges and other financial businesses. CERT-In named the threat actor CRAFTY FALCON on Wednesday while updating a warning first issued in October. The latest advisory specifically included cryptocurrency exchanges among affected businesses and described AI tools used in the attacks.

CERT-In said the campaign remains active. CERT-In said CSIRT-Fin continues to receive reports of successful attacks, including against nonbank financial companies and fintech businesses that received earlier restricted advisories and took remedial measures. The campaign also targets digital lending platforms, payment aggregators and service providers.

CERT-In said the attacker uses machine intelligence to examine targets, executes attacks at machine speed and invokes victims' payment and disbursement APIs. CERT-In said attackers exploited application vulnerabilities and exposed testing environments. CERT-In said shared credentials and access tokens enabled attackers to enter production systems. CERT-In also said attackers targeted cloud infrastructure to install malicious files.

AI tools enabled attackers to produce and improve attack scripts quickly. Attackers reverse-engineered application code to create exploits tailored to targets. Some attacks occurred during weekends and holidays to postpone detection. Attackers sometimes checked unauthorized transfers through small transactions before transferring larger amounts. CERT-In also reported thefts of cryptocurrency wallet keys and the removal of funds from wallets. CERT-In did not identify affected cryptocurrency exchanges or provide figures for losses.

CERT-In urged businesses to regard the campaign as active and intensifying. CERT-In recommended continuous security monitoring for at-risk companies. CERT-In also urged companies to increase staffing and lower alert thresholds during holidays, weekends and other periods with reduced coverage. Requests for comment were sent to CERT-In, CoinDCX, CoinSwitch, WazirX, ZebPay and Mudrex.

CrowdStrike reported in October that an unidentified attacker breached financial firms in South Korea and stole data using ARTEX, Claude Code and other AI models. ARTEX is an AI penetration-testing tool that CERT-In also identified in the advisory. The warning provides further evidence that hackers are using AI tools against financial institutions.

Solana Foundation chief information security officer Michael Coates previously argued that legitimate security teams need access to the most capable AI tools. Coates said defenders need the best available models because attackers will have sufficiently capable tools. TRM Labs head of policy Ari Redbord said in July that attack methods are advancing faster than a single launch-day audit can address. Redbord urged ongoing security reviews.