India warns AI-powered hackers targeting crypto exchanges at ‘machine speed’

CRAFTY FALCON is the name India’s Computer Emergency Response Team, or CERT-In, gave to an AI-assisted financial hacking campaign. The agency says the threat is active and escalating. Attackers have stolen wallet keys and siphoned funds. That makes the campaign important because it targets systems that move or hold money, not only databases containing information.

The campaign reaches nonbank lenders, digital lending platforms, fintech companies, payment aggregators, service providers and cryptocurrency exchanges. Attackers exploited vulnerable applications and exposed testing environments. They used shared credentials and access tokens to move toward production systems. They also targeted cloud infrastructure and deployed malicious files.

CERT-In said it continues receiving reports of successful attacks, including against NBFCs and fintech companies that had already remediated earlier warnings. The agency did not name affected exchanges or quantify losses. It urged companies to treat the campaign as active and escalating, with stronger monitoring, staffing and alerting during weekends and holidays.

AI-assisted hacking at “machine speed” means software helps attackers examine targets, create attack code and adapt their methods quickly. CERT-In said CRAFTY FALCON surveys targets with machine intelligence and strikes by invoking victims’ own payment and disbursement APIs. The danger is speed: defenders may have less time to notice and stop each stage.

The attackers used AI tools to rapidly generate and refine scripts. They also reverse-engineered application code, then developed exploits tailored to particular systems. CERT-In named ARTEX among the tools in its advisory. CrowdStrike previously reported an attacker using ARTEX, Paradox Code and other AI models against South Korean financial firms.

This does not mean the systems act without human involvement. It means AI accelerates reconnaissance, coding and adaptation inside an attack campaign. CERT-In therefore urged firms to monitor continuously, increase staffing and lower alert thresholds during weekends, holidays and other periods when fewer defenders may be watching.

The target set is broad because the campaign reaches businesses that lend, process, aggregate or move digital money. CERT-In listed nonbank lenders, digital lending platforms, fintech companies, payment aggregators and service providers. Its latest advisory also explicitly identified cryptocurrency exchanges among affected organizations.

The attackers did not focus on one kind of system. They exploited vulnerable applications and exposed testing environments, used shared credentials and access tokens, and targeted cloud infrastructure. They deployed malicious files and moved toward production systems. In some incidents, they tested small unauthorized transactions before attempting larger transfers.

The campaign’s breadth matters because one weakness can connect development, cloud and payment environments. CERT-In said it continues receiving reports of successful attacks, including from NBFCs and fintech entities that had already received earlier advisories and taken remediation steps. The agency did not identify affected exchanges or state total losses.

The campaign shows how separate weaknesses can combine into a path toward production. Attackers exploited vulnerable applications and exposed testing environments, where security controls may not match live systems. They also used shared credentials and access tokens. Those credentials and tokens helped them move from accessible environments into production systems.

Cloud infrastructure provided another route. CERT-In said attackers targeted cloud systems to deploy malicious files. Once inside relevant environments, they could reverse-engineer application code and create tailored exploits. They also invoked the victim’s own payment and disbursement APIs, turning legitimate financial functions into tools for unauthorized transfers.

The article does not describe one identical sequence in every incident. It reports these techniques as parts of the campaign and notes that some attackers validated transfers with small test transactions before moving larger sums. This combination makes monitoring important across testing, cloud, identity and production payment systems, rather than at one network boundary.

The most direct consequence is financial loss. CERT-In reported stolen cryptocurrency wallet keys and funds drained from wallets. It also said attackers struck by invoking victims’ payment and disbursement APIs. If those APIs accept unauthorized instructions, attackers can use the organization’s own transfer machinery to send money elsewhere.

The campaign included a cautious-looking step before larger thefts. In some incidents, attackers used small test transactions to validate unauthorized transfers. After confirming that the path worked, they moved larger sums. Possession of a wallet’s private key can similarly allow control of the assets associated with that wallet, because the key authorizes transactions.

The article does not name affected crypto exchanges or quantify losses. It does show that consequences can include stolen keys, drained wallets and unauthorized payments. The risk is especially serious for firms whose APIs, credentials or cloud systems connect directly to production funds and disbursement processes.

Financial firms can reduce the window for rapid attacks by watching systems around the clock. CERT-In specifically advised heightened security monitoring, increased staffing and lowered alert thresholds during holidays, weekends and other low-coverage periods. Those steps address the campaign’s timing, since some attacks were launched when detection could be delayed.

Monitoring should cover more than login activity. Firms need visibility across exposed testing environments, production applications, cloud infrastructure, access tokens and payment or disbursement APIs. Small unauthorized transactions can serve as warnings, because attackers reportedly used them to validate transfer paths before moving larger sums. Rapid review of unusual transfers can limit damage.

CERT-In told at-risk entities to treat the campaign as active and escalating. The article also cites calls for continuous security reviews, because attack techniques can move faster than a single audit. Firms therefore need repeated checks and fast response processes, not only a one-time assessment before launch.

A cryptocurrency wallet’s private key is a secret cryptographic credential used to authorize transactions associated with the wallet. It is not the public wallet address that others may use to send funds. The private key proves control when the holder signs a transaction, so protecting it is central to protecting the wallet’s assets.

In practice, someone who obtains the private key can generally create authorized-looking transfers from that wallet. The blockchain network then sees a valid authorization, even if the legitimate owner did not intend the payment. That is why theft of wallet keys can lead to funds being drained. CERT-In specifically reported stolen cryptocurrency wallet keys in the campaign.

The article does not explain private keys in detail; this definition uses established cryptocurrency knowledge. It does report the consequence: attackers stole keys and siphoned funds. The warning therefore connects technical credential theft with direct financial loss, especially when keys or related systems are exposed.