India’s Computer Emergency Response Team (CERT-In) has issued an official advisory regarding an escalation in artificial intelligence (AI)-powered cyberattacks targeting cryptocurrency exchanges and financial institutions. The threat actor group, codenamed CRAFTY FALCON, represents an update to an initial advisory issued in October 2026. In the latest advisory, crypto exchanges were identified as active targets alongside non-banking financial companies (NBFCs), digital lending platforms, payment aggregators, and fintech firms.
Field data indicates that the threat remains active. The Financial Sector Computer Security Incident Response Team (CSIRT-Fin) continues to receive reports of successful attacks, even from entities that had previously received initial mitigation guidance. CERT-In stated that CRAFTY FALCON scouts targets using machine intelligence, operates at machine speed, and strikes by triggering victims’ own payment and payout APIs.
Breaching Production Systems via Test Credentials
The attackers utilize AI tools to reverse-engineer application code, as well as generate and modify exploit scripts within seconds. Exploited attack vectors include vulnerable applications, shared credentials, and access tokens in testing environments. From these testing loopholes, hackers pivot into production systems and cloud infrastructure.
This advisory aligns with findings from cybersecurity firm CrowdStrike in October regarding a hacking group using an AI penetration testing tool called ARTEX and the Claude Code AI model to breach South Korean financial institutions. The advent of such automation tools allows code exploitation to execute instantaneously once a vulnerability is identified.
Weekend Attacks and Small-Amount Test Transfers
The timing of the attacks is deliberately designed to slow down response efforts. CRAFTY FALCON launches its operations during weekends and public holidays to delay detection by victims’ internal security teams.
The attackers’ modus operandi begins with small test transfers before moving larger sums. Through these stages, hackers steal crypto wallet private keys and subsequently drain the targeted wallet balances.
Demands for 24/7 Round-the-Clock Monitoring
In response to attacks moving at machine speed, CERT-In urged crypto exchanges and financial service providers to step up round-the-clock security monitoring. The Indian cyber regulator also instructed operators to lower alert thresholds and augment security personnel during low-supervision periods.
For exchange operators and lending platform providers, the CRAFTY FALCON threat demonstrates that breaches often originate from lax security in testing environments. Safeguarding wallet balances now requires tightening test access tokens and maintaining readiness against attacks that strike at machine speed.
Reported by Cointelegraph.
Disclaimer: This article is for informational and educational purposes only, not financial advice. Cryptocurrency assets are highly volatile and carry significant risk. Always do your own research (DYOR) and never invest more than you can afford to lose.
