CERT-In Warns of AI-Powered Hacks on Indian Crypto Exchanges
CERT-In Warns of AI-Powered Hacks on Indian Crypto Exchanges – Platforms Urged to Strengthen Security Protocols
Key Takeaways
- India’s cyber agency issued a Critical warning on November 4 regarding the hacker group CRAFTY FALCON targeting crypto and fintech platforms.
- Attackers utilize public AI tools to automate attack chains and steal wallet keys from digital asset service providers.
- CERT-In recommends implementing hardware security modules, multi-signature approvals, and beneficiary cooling periods to protect user funds.
- Firms are advised to increase staffing and lower alert thresholds during upcoming holidays to counter targeted weekend attacks.
Automated Attack Chains Exploit Platform APIs
The Indian cyber agency CERT-In has identified a coordinated campaign by an AI-assisted hacker group targeting cryptocurrency exchanges and fintech payment systems. The agency issued a Critical warning on November 4, identifying the threat actor as CRAFTY FALCON. The finance unit of CERT-In, known as CSIRT-Fin, reports that financial firms are currently experiencing successful breaches. The attackers focus on virtual digital asset service providers, extracting wallet keys from these platforms to drain funds directly from their crypto wallets.
The group leverages publicly available AI tools to execute these breaches. The advisory specifically names PentAGI and CyberStrikeAI as instruments used in the attacks. These systems are capable of running full attack chains autonomously while adjusting their payloads based on how the target systems respond. The public advisory does not specify which firms have been affected or disclose the total amount of stolen funds.
Before executing large unauthorized transfers, the hackers probe the victim platforms. The attackers send small test payments, such as a transfer of Rs. 1, to confirm that their chosen route is operational. Once the route is verified, the group moves money directly through the payment application programming interfaces of the victims.
Holiday Periods See Increased Attack Frequency
The cyber agency noted a distinct pattern in the timing of these unauthorized transfers. The hacker group actively schedules its raids for weekends and holidays. These periods typically see fewer technical staff monitoring financial systems, giving the attackers a wider window to operate undetected.
The upcoming Diwali festival, which falls on Sunday, November 8, presents a high-risk period for both crypto exchanges and traditional financial services. CERT-In explicitly advises firms to lower their alert thresholds during such windows to catch suspicious activity earlier. Companies are instructed to add technical staff to monitor systems over the holiday weekend.
The attacks have not been limited to crypto platforms. The threat actors have also returned to non-banking financial companies and fintech operators that had previously received restricted warnings. This persistence indicates that initial defensive measures implemented by these firms did not fully neutralize the threat.
Historical Breaches Highlight Scale of Financial Risks
While current loss figures remain undisclosed, past incidents demonstrate the potential financial impact of compromised exchange wallets. In July 2024, hackers successfully extracted more than $230 million from the Indian exchange WazirX. The platform later restarted in October 2025 following a restructuring process approved by a Singapore court. Eligible users of the exchange eventually received approximately 85% of their approved claims.
Different exchanges handle large-scale losses in various ways. Binance experienced a $6.3 billion loss on October 29. The global exchange stated that it covered roughly 95% of this missing capital by drawing from its own internal reserves. Disclosures from currently affected lenders or exchanges will be necessary to determine exactly how much capital the new hacker group has managed to extract from Indian platforms.
Cyber Agency Recommends Structural Security Overhauls
To mitigate the ongoing threat, CERT-In has outlined specific security protocols for all crypto platforms and digital asset service providers. The agency strongly advises moving wallet keys into hardware security modules or maintaining them in strict cold custody. These measures isolate the sensitive keys from internet-connected systems, making remote extraction significantly more difficult for attackers.
The advisory also calls for multi-signature approval processes for all cryptocurrency withdrawals. This protocol requires multiple independent authorizations before any digital assets can leave a platform wallet. The agency recommends implementing mandatory cooling periods for new beneficiaries across all payment networks.
These required security layers alter the operational flow for end users. Multi-signature approvals and cooling periods inherently add extra verification steps before any money can move through the system. The cyber agency notes that these additional checks could slow down standard withdrawals and payouts for customers using the affected platforms. The full indicators of compromise detailing the attack methods have only been shared with financial firms through a restricted version of the advisory.
Our Assessment
The emergence of AI-driven attack vectors presents a substantial operational challenge for the crypto and fintech sectors in India. The ability of tools to autonomously adjust payloads and exploit native payment APIs requires platforms to rethink their real-time security monitoring. By shifting attacks to low-staff periods like weekends and holidays, threat actors are maximizing their chances of extracting wallet keys before manual interventions can occur. The regulatory push toward cold custody, multi-signature withdrawals, and beneficiary cooling periods introduces friction into the transaction process. While these measures aim to secure user assets against automated exploitation, they will likely result in slower payout times for customers navigating the crypto ecosystem.
