India’s national cybersecurity agency, the Indian Computer Emergency Response Team (CERT‑In), issued a fresh advisory on Wednesday warning that an AI‑assisted threat actor known as “Crafty Falcon” has intensified attacks on cryptocurrency exchanges and other financial service providers. The advisory, an update to a campaign first flagged in October, describes the group’s use of machine‑learning tools to conduct rapid, automated assaults that have resulted in stolen wallet keys and drained crypto funds.

AI‑enhanced tactics and attack chain

According to the CERT‑In notice, Crafty Falcon leverages AI penetration‑testing tools such as ARTEX, along with large language models like Claude Code, to scan potential targets, reverse‑engineer application code and craft bespoke exploits. The group exploits vulnerable applications, misconfigured cloud infrastructure and shared credentials to move from testing environments into production systems. AI‑generated scripts enable the attackers to “survey its targets with machine intelligence, operate at machine speed and strike by invoking the victim’s own payment and disbursement APIs,” the agency said. In several cases, the actors performed small test transactions to confirm unauthorized transfers before executing larger withdrawals.

Scope of the campaign

The advisory lists non‑bank lenders, digital lending platforms, fintech firms, payment aggregators and crypto exchanges as affected sectors. While CERT‑In did not name specific exchanges or disclose the monetary impact, it confirmed that wallet keys have been compromised and funds siphoned from affected wallets. The campaign appears to time attacks for weekends and holidays, aiming to evade detection when security staffing is reduced.

Industry response and mitigation guidance

CERT‑In urged at‑risk entities to treat the campaign as active and escalating, recommending round‑the‑clock security monitoring, increased staffing and lowered alert thresholds during low‑coverage windows. The agency also advised firms to harden cloud configurations, enforce strict credential hygiene and isolate testing environments from production. Security experts echoed the warning; Michael Coates of the Solana Foundation stressed the need for defenders to access the strongest AI tools, while Ari Redbord of TRM Labs warned that attack techniques now outpace a single audit’s ability to keep up.

What to watch next

Observers will be monitoring whether Indian regulators issue formal directives or penalties for firms that fail to adopt the recommended safeguards. Additional disclosures from affected exchanges could reveal the scale of losses and prompt broader industry collaboration on AI‑driven threat intelligence. Continued reports of AI‑assisted breaches in other jurisdictions may also signal a global shift toward more automated cyber‑crime targeting the crypto sector.