CERT-In Cautions Against AI-Driven Attacks Targeting Crypto Exchanges, Financial Firms

India’s cybersecurity agency, CERT-In, has cautioned financial institutions about an escalation in artificial intelligence (AI)-assisted cyber attacks targeting entities, including cryptocurrency exchanges. The attackers have exploited payment and disbursement application programming interfaces (APIs) to carry out unauthorised transactions, with wallet keys stolen and funds siphoned from cryptocurrency wallets.

In an advisory issued on November 4, 2026, CERT-In identified the fraudster as CRAFTY FALCON and classified the threat as critical. The affected entities include non-banking financial companies (NBFCs), digital lending platforms, fintech firms, payment aggregators, payment service providers, and cryptocurrency exchanges, also known as virtual digital asset (VDA) service providers.

How CRAFTY FALCON Uses AI Tools To Target Financial Firms

CERT-In said the attackers have used publicly available AI-driven security tools, including the ARTEX family of large language model-based tools, PentAGI, Cairn and CyberStrikeAI. These tools execute attack chains autonomously, generate customised scripts, and modify payloads based on responses from targeted systems.

The attackers have targeted cloud infrastructure, including AWS Systems Manager and Lambda, to execute commands and deploy malicious files. They have also used Internet-facing testing and staging environments as entry points before moving into production systems through shared credentials, tokens or network connections.

Other methods include reverse-engineering application code to make unauthorised API calls through modified application packages and bypassing IP allow-lists by routing traffic through shared third-party fetcher services.

The attackers have also exploited merchant settlement APIs of payment aggregators and newly-disclosed vulnerabilities in PHP and Node.js applications. In some cases, they conducted small test transactions, including payments of Rs 1, to verify unauthorised fund flows before attempting larger transfers.

CERT-In said cryptocurrency exchanges and VDA service providers had been targeted, with attackers stealing wallet keys and siphoning funds from cryptocurrency wallets.

The advisory updates an earlier warning issued on October 9, 2026 about the exploitation of payment and disbursement APIs. CERT-In said the campaign remains active, with some entities previously alerted about the threat being targeted again after incomplete remediation. Attacks have also been timed around weekends and holidays, when security monitoring may be limited.

CERT-In Recommends Stronger Security Measures

CERT-In has directed financial institutions to implement continuous security monitoring along with additional staff and reduced alert triggers during weekends and holidays. It has also recommended keeping testing environments separate from production systems and limiting access to cloud management services to authorised users.

For payment systems, CERT-In has recommended server-side transaction validation, API request signing and monitoring of small test transactions followed by high-value transfers.

For cryptocurrency exchanges, the advisory suggested storing wallet keys in hardware security modules or cold custody, requiring multi-signature approvals for withdrawals and monitoring unusual withdrawal patterns. Exchanges have also been advised to rotate wallet keys immediately if a compromise is suspected.

CERT-In has asked entities to isolate affected systems, preserve forensic evidence, rotate compromised credentials, and report suspicious activity to CERT-In and CSIRT-Fin at incident@cert-in.org.in. The advisory also directs entities to report bulk fraudulent transactions through the Cyber Fraud Mitigation Centre (CFCFRMS) portal.