India warns AI-powered hackers targeting crypto exchanges at ‘machine speed’
India's cybersecurity agency has identified an AI-assisted threat actor, 'CRAFTY FALCON,' escalating attacks on cryptocurrency exchanges and financial businesses, stealing wallet keys and siphoning funds.
India's national cybersecurity agency has designated an AI-assisted threat actor as 'CRAFTY FALCON,' escalating attacks on cryptocurrency exchanges and other financial businesses. The Indian Computer Emergency Response Team (CERT-In) issued the warning in an update to a campaign first reported in October, now explicitly identifying crypto exchanges among affected targets.
Machine Speed Attacks
CERT-In described how CRAFTY FALCON 'surveys its targets with machine intelligence, operates at machine speed and strikes by invoking the victim's own payment and disbursement APIs.' The campaign has targeted nonbank lenders, digital lending platforms, fintech companies, payment aggregators, and crypto exchanges.
Attackers exploited vulnerable applications and exposed testing environments, using shared credentials and access tokens to move into production systems. They also targeted cloud infrastructure to deploy malicious files while using AI tools to rapidly generate and refine attack scripts.
Stolen Funds and Keys
In some incidents, attackers used small test transactions to validate unauthorized transfers before moving larger sums. CERT-In also reported stolen cryptocurrency wallet keys and funds drained from wallets, though the agency did not name any affected exchanges or quantify losses.
The threat is active and ongoing. CSIRT-Fin continues to receive reports of successful attacks, including from NBFCs and fintech entities that had already received the earlier restricted advisories and had undertaken remediation.
Security Response
CERT-In has advised entities to 'treat this campaign as active and escalating,' urging at-risk companies to heighten security monitoring around the clock with increased staffing and lowered alert thresholds during holidays and weekends.
Security experts emphasize the need for defenders to access advanced AI tools. 'We need to make sure that the best models we can get are in the hands of defenders because attackers will have something capable enough,' said Michael Coates, CISO at Solana Foundation. Ari Redbord of TRM Labs similarly noted that 'attack techniques are moving faster than a single audit from launch day can account for,' urging continuous security reviews.
Related
