India flags AI-assisted attacks on crypto exchanges as South Korea tightens cold-storage checks

Two Asian regulators are moving on the same problem from different angles: India’s CERT-In says an AI-assisted threat actor is hitting crypto exchanges at “machine speed,” while South Korea is pushing local exchanges to harden custody controls after the $6.3 billion attack on Binance. For PSPs and other financial providers, the point is simple: exchange security is now a supervisory issue, not just an IT one.

1. India’s national cybersecurity agency warned that an AI-assisted threat actor has escalated attacks on cryptocurrency exchanges and other financial businesses, stealing wallet keys and siphoning funds. The Indian Computer Emergency Response Team (CERT-In) on Wednesday designated the group “CRAFTY FALCON” and said crypto exchanges are among the affected businesses.
2. CERT-In said, “The threat is active and ongoing. CSIRT-Fin continues to receive reports of successful attacks, including from NBFCs and fintech entities that had already received the earlier restricted advisories and had undertaken remediation.” That matters because the warning is not about a theoretical campaign; it is about repeated compromise after prior advisories and remediation efforts.
3. The advisory adds to a broader pattern of hackers using AI tools against financial institutions. In October, CrowdStrike reported that an unidentified attacker used ARTEX, an AI penetration-testing tool also named in CERT-In’s advisory, alongside Claude Code and other AI models to breach South Korean financial firms and steal data.
4. In South Korea, the Financial Services Commission said it held an emergency meeting with other regulators, cybersecurity agencies and crypto service providers after the $6.3 billion attack on Binance. The FSC reviewed IT access controls, wallet withdrawal approval and signing procedures, and administrator privileges, and urged providers to increase the proportion of assets held in offline cold wallets.
5. South Korean law already requires exchanges to keep at least 80% of users’ crypto assets in cold storage. The FSC’s push therefore sits on top of an existing custody rule, with Upbit keeping 99.17% assets in cold wallets, Bithumb at 94.76%, and Coinone at 85%.
6. The Bank of Korea is also looking beyond exchange ops and into second-order risk. It is surveying 31 financial institutions on how a major exchange shutdown, a prolonged crypto downturn, or losses at another firm could affect their operations, including a scenario in which South Korea’s largest crypto exchange by market share temporarily suspends operations after a major hack or similar incident.

For high-risk PSPs, the useful read-through is that regulators are now treating exchange custody, access control and interconnection risk as part of the wider financial stability picture. If your merchants depend on crypto rails, the question is no longer only whether the exchange can process withdrawals; it is how its controls stand up when the next incident lands.