India warns of AI-driven hackers targeting crypto exchanges

India's national cybersecurity agency has issued a serious warning regarding an active hacking campaign, noting that an artificial intelligence-assisted threat actor has intensified attacks against cryptocurrency exchanges and several other financial institutions. According to officials, the campaign is leveraging advanced machine intelligence to infiltrate digital assets, steal wallet keys, and drain funds at an unprecedented pace.

In a recent advisory update, the Indian Computer Emergency Response Team identified the responsible threat actor as “CRAFTY FALCON,” building upon initial warnings issued earlier in October. The latest agency bulletins explicitly highlight crypto exchanges alongside digital lending platforms, nonbank lenders, fintech businesses, payment aggregators, and various service providers as primary targets of the ongoing digital threat.

India AI power and the emerging cyber threat

The cybersecurity authority reported that the threat actor thoroughly surveys intended targets using intelligent automation, operating at remarkable speed to strike directly by invoking the victims' own payment and disbursement APIs. Investigators discovered that attackers systematically exploit vulnerable applications, exposed testing environments, shared credentials, and access tokens to transition smoothly into live production systems, while also breaching cloud infrastructure to plant malicious files.

Furthermore, the malicious actors utilize artificial intelligence tools to rapidly generate, test, and refine attack scripts. They have reverse-engineered complex application code to build custom exploits, often scheduling their disruptive activities during weekends and holidays to minimize immediate detection. In certain observed incidents, perpetrators executed small preliminary test transactions to verify unauthorized transfers before siphoning larger sums of money.

AI-powered threat actors are executing rapid cyberattacks against digital financial infrastructure and cryptocurrency exchanges.

CERT-In has strongly advised vulnerable organizations to treat the ongoing campaign as an escalating threat. The agency urges digital service providers to maintain round-the-clock security monitoring, elevate staffing levels, and lower alert thresholds during weekends and holidays when detection response times might otherwise lag.

Why it matters

This escalating threat exposes vulnerabilities within modern digital finance, affecting cryptocurrency platforms, fintech firms, and nonbank lenders across the region. As automated cyber threats accelerate, financial institutions face heightened risks of fund loss, requiring immediate security enhancements and continuous operational vigilance.