CERT-In warns AI-assisted hackers are stealing crypto exchange wallet keys

What CERT-In said

The Indian Computer Emergency Response Team (CERT-In) first warned about this campaign in October. Its updated advisory, rated critical, now names the attacker CRAFTY FALCON and, for the first time, lists crypto exchanges and virtual digital asset (VDA) service providers among the targets.

According to the advisory, as reported by Cointelegraph and Outlook Money, the attackers stole wallet keys and siphoned funds from crypto wallets. They also abused payment and disbursement APIs at lenders, fintech companies and payment firms to push through unauthorised transfers.

CERT-In says the campaign is active. It adds that some firms it had already warned were hit again because their fixes were incomplete.

Why "AI-assisted" matters

CERT-In says the attackers used publicly available AI tools to scan systems, find weak spots and write attack scripts quickly. BeInCrypto reports the advisory names tools such as PentAGI and CyberStrikeAI.

In plain terms, attacks that used to take a skilled team days can now be run much faster, at "machine speed", as the agency put it. Exposed test servers, shared passwords and leaked access tokens are the doors they look for.

What CERT-In told exchanges to do

The advisory asks crypto platforms to:

• keep wallet keys in hardware security modules or cold storage
• require more than one person to approve withdrawals (multi-signature)
• watch for unusual withdrawal patterns, including small test transfers before large ones
• rotate wallet keys straight away if a leak is suspected

What it means for you

This is a warning about attacks on companies, not on your personal login. Still, an exchange that loses funds can pause withdrawals, as Binance did after its record hack last month.

Sensible steps this week:

• Lock down your account. Use an authenticator app or passkey, not SMS. Our 2FA guide shows how.
• Turn on a withdrawal whitelist so funds can only go to addresses you have approved.
• Don't keep more on an exchange than you need. Spread risk, or use your own wallet for long-term holdings.
• Ignore "your account is compromised" calls and messages over the festive weekend. Exchanges won't ask for your OTP or seed phrase.

Work through our wallet security checklist for the full list.

What to watch

Whether any Indian exchange confirms an incident linked to this campaign, and whether regulators tighten security rules for VDA platforms. We will update this story if CERT-In or an exchange publishes more.

Frequently asked questions

Which Indian exchanges were hacked?

CERT-In did not name any affected exchange and did not say how much was stolen. Be wary of posts on social media that claim to know, unless the exchange itself has confirmed it.

Is my crypto on an Indian exchange at risk?

The warning is aimed at the companies' own systems, such as hot wallets and payment links, not individual user accounts. Your main protection is the same as always: strong 2FA, a withdrawal whitelist, and not keeping more on any exchange than you need. See our exchange safety board.

Should I move my crypto to my own wallet?

That is your choice. A self-custody wallet removes exchange risk but makes you fully responsible for your seed phrase. Read what a self-custody wallet is before you decide.

Sources

• Cointelegraph: India warns AI-powered hackers targeting crypto exchanges at 'machine speed'
• Outlook Money: CERT-In cautions against AI-driven attacks targeting crypto exchanges, financial firms
• BeInCrypto: CERT-In warns AI-powered hacker group is hitting India's crypto and fintech firms
• The Crypto Times: India's CERT-In warns of AI hackers targeting crypto exchanges

Get the day’s crypto newsletters summarised on Telegram: Indefi Brief →