India’s Cybersecurity Agency Escalates Warning on AI-Powered Attacks Against Crypto Exchanges
India's national cybersecurity authority has identified an escalating threat campaign using artificial intelligence to target cryptocurrency exchanges and financial institutions, with attackers stealing digital assets at rapid speeds.
AI-Enhanced Attack Campaign Spreading
According to CERT-In (Indian Computer Emergency Response Team), a sophisticated threat actor designated “Crafty Falcon” has intensified its focus on cryptocurrency exchanges alongside other financial sector targets. The agency, which first disclosed elements of this campaign in October, released an updated advisory explicitly naming digital asset platforms as priority victims. The attackers have demonstrated capability to breach systems, extract wallet keys, and drain cryptocurrency holdings from compromised accounts.
Machine-Speed Operations and Tactical Precision
What distinguishes this threat is the integration of artificial intelligence into attack methodology. CERT-In described the threat actor as operating “at machine speed” and using AI tools to systematically survey targets before striking. The campaign leverages AI penetration-testing frameworks—including a tool called ARTEX—alongside large language models to generate and refine attack scripts in real time. This mirrors activity documented by cybersecurity researchers in October when attackers used similar AI-powered techniques to compromise South Korean financial institutions.
The operational approach involves exploiting overlooked vulnerabilities in applications, accessing exposed development environments, and leveraging improperly secured credentials to penetrate production systems. Cloud infrastructure has also been weaponized as a staging area for malicious payloads. To avoid immediate detection, attackers carefully time operations around weekends and holidays when security monitoring is typically reduced. In several instances, they conducted small-value test transactions before executing large unauthorized transfers—a technique that validates access to payment systems before committing to major theft operations.
Defensive Imperatives for the Industry
CERT-In has directed organizations in the financial and cryptocurrency sectors to treat this campaign as an active, escalating threat requiring constant vigilance. The agency recommends implementing round-the-clock security monitoring, expanding incident response teams during lower-coverage periods, and configuring alert systems with significantly lowered detection thresholds to catch subtle intrusion patterns.
Security leaders in the crypto space emphasize that defenders must have equivalent access to cutting-edge AI capabilities. Michael Coates, chief information security officer at the Solana Foundation, highlighted that protective teams require the most sophisticated AI models available to match adversary capabilities. Similarly, policy experts have noted that security assessments conducted at platform launch cannot account for the speed at which attack techniques now evolve, necessitating continuous security reassessment cycles rather than static reviews.
For crypto platforms and their users, AI-powered attacks represent a rapidly escalating threat requiring urgent defensive evolution.
Source: CERT-In, via Cointelegraph. Not financial advice.