India warns AI-powered hackers targeting crypto exchanges at ‘machine speed’

India’s national cybersecurity agency warned that an AI-assisted threat actor has escalated its attacks on cryptocurrency exchanges and other financial businesses, stealing wallet keys and siphoning funds.

The Indian Computer Emergency Response Team (CERT-In) on Wednesday designated the threat actor as “CRAFTY FALCON,” in an update to a campaign it first warned about in October. The latest advisory has now explicitly identified crypto exchanges among affected businesses and detailed the use of AI attack tools.

“The threat is active and ongoing. CSIRT-Fin continues to receive reports of successful attacks, including from NBFCs and fintech entities that had already received the earlier restricted advisories and had undertaken remediation,” said CERT-In.

The warning adds to evidence of hackers using AI tools against financial institutions. In October, cybersecurity firm CrowdStrike reported that an unidentified attacker used ARTEX, an AI penetration-testing tool also named in CERT-In’s advisory, alongside Claude Code and other AI models to breach South Korean financial firms and steal data.

CERT-In said the AI-assisted financial threat actor “surveys its targets with machine intelligence, operates at machine speed and strikes by invoking the victim’s own payment and disbursement APIs.”

The campaign has targeted nonbank lenders, digital lending platforms, fintech companies, payment aggregators and service providers, as well as crypto exchanges.

According to CERT-In, attackers exploited vulnerable applications and exposed testing environments, using shared credentials and access tokens to move into production systems. They also targeted cloud infrastructure to deploy malicious files.

AI tools helped attackers rapidly generate and refine attack scripts. The attackers also reverse-engineered application code to develop tailored exploits, while some attacks were timed for weekends and holidays to delay detection.