India warns AI-powered hackers are targeting crypto exchanges at “machine speed”

India’s national cybersecurity agency says an AI-assisted threat actor has escalated attacks on cryptocurrency exchanges and other financial firms, with stolen wallet keys and drained funds among the reported outcomes. For PSPs and exchanges, the important part is not the headline drama; it’s that the attacks are now explicitly aimed at payment and disbursement APIs.

1. The Indian Computer Emergency Response Team (CERT-In) on Wednesday identified the threat actor as “CRAFTY FALCON” in an updated advisory, after first warning about the campaign in October. The latest notice explicitly names crypto exchanges among the affected businesses and says the attacks use AI tools.
2. CERT-In said the threat is “active and ongoing,” adding that CSIRT-Fin continues to receive reports of successful attacks, including from NBFCs and fintech entities that had already received earlier restricted advisories and had undertaken remediation. In other words: patching once was not the end of it.
3. According to the agency, CRAFTY FALCON operates at “machine speed,” surveys targets with machine intelligence, and strikes by invoking the victim’s own payment and disbursement APIs. CERT-In said the campaign has targeted nonbank lenders, digital lending platforms, fintech companies, payment aggregators and service providers, as well as crypto exchanges.
4. The attackers reportedly exploited vulnerable applications and exposed testing environments, then used shared credentials and access tokens to move into production systems. CERT-In also said they targeted cloud infrastructure to deploy malicious files, used AI tools to generate and refine attack scripts, reverse-engineered application code to build tailored exploits, and timed some attacks for weekends and holidays to delay detection.
5. In some incidents, attackers used small test transactions to validate unauthorized transfers before moving larger sums. CERT-In also reported stolen cryptocurrency wallet keys and funds drained from wallets. The agency did not name any affected crypto exchanges or quantify losses.

CERT-In urged at-risk companies to treat the campaign as active and escalating, with 24/7 monitoring, increased staffing, and lower alert thresholds during holidays, weekends and other low-coverage windows. For high-risk payment businesses, that is the operational takeaway: the attacker is not only abusing infrastructure, but also trying to hit when human coverage is weakest.