India's Computer Emergency Response Team designated an AI-assisted threat actor as CRAFTY FALCON on November 4, 2026, saying the campaign has escalated against crypto exchanges and financial firms. The agency said attackers stole wallet keys and drained funds, and that it did not name affected exchanges or quantify losses.
CERT-In said crypto exchanges are among the businesses targeted by CRAFTY FALCON, and that attackers have stolen wallet keys and drained funds, though the agency did not name affected venues or quantify losses.
India's Computer Emergency Response Team (CERT-In) warned that an AI-assisted threat actor has escalated attacks on cryptocurrency exchanges and other financial businesses, stealing wallet keys and draining funds. In an update to a campaign it first warned about in October, the agency on Wednesday, November 4, 2026, designated the actor as CRAFTY FALCON and explicitly identified crypto exchanges among affected businesses.
"The threat is active and ongoing. CSIRT-Fin continues to receive reports of successful attacks, including from NBFCs and fintech entities that had already received the earlier restricted advisories and had undertaken remediation," CERT-In said. The agency did not name any affected crypto exchanges or quantify losses.
CERT-In said the actor "surveys its targets with machine intelligence, operates at machine speed and strikes by invoking the victim's own payment and disbursement APIs." The campaign has targeted nonbank lenders, digital lending platforms, fintech companies, payment aggregators and service providers, as well as crypto exchanges.
According to CERT-In, attackers exploited vulnerable applications and exposed testing environments, using shared credentials and access tokens to move into production systems, and targeted cloud infrastructure to deploy malicious files. AI tools helped attackers rapidly generate and refine attack scripts, and attackers reverse-engineered application code to develop tailored exploits. Some attacks were timed for weekends and holidays to delay detection, and in some incidents small test transactions validated unauthorized transfers before larger sums moved.
The warning follows an October report by cybersecurity firm CrowdStrike that an unidentified attacker used ARTEX, an AI penetration-testing tool also named in CERT-In's advisory, alongside Claude Code and other AI models to breach South Korean financial firms and steal data. CERT-In advised entities to "treat this campaign as active and escalating," urging at-risk companies to heighten monitoring around the clock with increased staffing and lowered alert thresholds during holidays, weekends and other low-coverage windows.
Solana Foundation chief information security officer Michael Coates previously told Cointelegraph that legitimate security teams need access to the strongest AI tools. "We need to make sure that the best models we can get are in the hands of defenders because attackers will have something capable enough," he said. TRM Labs head of policy Ari Redbord told Cointelegraph in July that "attack techniques are moving faster than a single audit from launch day can account for," urging continuous security reviews.
Pick the topics you care about. Get only what matters, on your cadence.