India warns AI-assisted hackers are stealing crypto wallet keys

India's Computer Emergency Response Team (CERT-In) has issued a critical warning about escalating AI-assisted attacks on banking, financial services and insurance entities, including repeat targeting after incomplete remediation. Its Nov. 4 CRAFTY FALCON advisory describes an ongoing campaign that abuses financial institutions' own cloud services and payment interfaces to move funds.

Cryptocurrency exchanges and virtual digital asset service providers are among the affected categories. CERT-In reports stolen wallet keys and funds siphoned from cryptocurrency wallets, placing crypto custody within a broader warning that also covers non-bank financial companies, digital lending platforms, fintech firms and payment providers.

Attack Methods

CERT-In describes several routes through institutions' infrastructure. Internet-facing testing and staging environments have provided entry points, followed by access to production systems through shared credentials, tokens or network connections. Modified application packages have also been used to initiate unauthorized API calls, defeating controls that assumed requests would come only from the legitimate application.

The agency specifically identifies re-targeting after incomplete remediation, with attacks timed for holidays, weekends and other periods of reduced monitoring. CERT-In attributes the campaign's AI assistance to its incident analysis, identifying publicly available offensive-security tools including ARTEX, PentAGI, Cairn and CyberStrikeAI.

Protection Measures

CERT-In recommends replacing reliance on approved IP addresses with controls that authenticate the requesting party, such as mutual TLS, cryptographically signed requests or scoped API keys on dedicated vendor endpoints. The agency also describes micro-value test transactions, such as one rupee, used to check unauthorized fund flows before larger transfers.

For crypto service providers, CERT-In recommends storing wallet keys in hardware security modules or cold custody, requiring multi-signature approvals for withdrawals and monitoring withdrawal patterns for anomalies. Keys should be rotated immediately when compromise is suspected.

The public advisory names no affected exchange and quantifies no losses. CERT-In calls for heightened round-the-clock monitoring, with more coverage during weekends and holidays. For institutions recovering from an incident, the advisory recommends forensic verification that the intrusion has been eradicated, followed by continued threat hunting.