India's national cybersecurity agency is warning that an artificial intelligence-assisted hacking group continues to breach financial companies, including cryptocurrency exchanges, in some cases hitting firms that had already patched their systems after earlier advisories.

The Indian Computer Emergency Response Team (CERT-In), which operates under the Ministry of Electronics and Information Technology, identified the threat actor as "CRAFTY FALCON" in an updated advisory released on Wednesday. The new advisory builds on a warning the agency first issued in October, and it is the first to list crypto exchanges directly among the targeted businesses. It also details how the group uses AI tools to plan and execute its attacks.

Firms Breached Even After Earlier Warnings

CERT-In said the campaign shows no signs of slowing down. "The threat is active and ongoing," the agency said.

According to the advisory, CERT-In's financial sector response team, CSIRT-Fin, continues to receive reports of successful intrusions. Some came from nonbank lenders and fintech companies that had already received earlier restricted advisories — alerts distributed privately to a limited set of firms rather than published — and had taken steps to remediate their systems. Digital lending platforms, payment aggregators and service providers have also been targeted.

The agency said the attackers stole cryptocurrency wallet keys and drained funds from wallets — for crypto businesses, that means a breach can convert directly into lost assets, since wallet keys are themselves the credentials that control the funds. CERT-In did not name any affected crypto exchanges, and it did not disclose how much money was lost. Cointelegraph contacted CERT-In and several Indian crypto platforms for comment, including CoinDCX, CoinSwitch, WazirX, ZebPay and Mudrex. Any responses from those platforms — or a future advisory that names victims or quantifies losses — would provide the first public accounting of the campaign's cost to the crypto sector.

How the AI-Assisted Attacks Work

CERT-In said the group "surveys its targets with machine intelligence, operates at machine speed and strikes by invoking the victim's own payment and disbursement APIs." In practice, the attackers use a company's own payment systems to move money out.

The intrusions typically begin with weak applications and testing environments exposed online. From there, the attackers use shared login credentials and access tokens to move laterally into live production systems. They also target cloud infrastructure to plant malicious files.

AI tools help the group rapidly write and improve attack scripts, while reverse-engineering application code allows it to build exploits tailored to each target. In some cases, the attackers sent small test transactions to confirm a transfer would succeed before moving larger amounts. CERT-In said some attacks were timed for weekends and holidays, when fewer staff are monitoring systems, helping the intruders delay detection.

The advisory also named ARTEX, an AI penetration-testing tool. In October, cybersecurity firm CrowdStrike reported that an unknown attacker used ARTEX, along with Claude Code and other AI models, to breach South Korean financial firms and steal data.

Security experts have warned about this trend before. Solana Foundation chief information security officer Michael Coates told Cointelegraph that defenders need access to the strongest AI tools. "We need to make sure that the best models we can get are in the hands of defenders because attackers will have something capable enough," he said.

In July, TRM Labs head of policy Ari Redbord said "attack techniques are moving faster than a single audit from launch day can account for." He called for ongoing security reviews.

Agency Urges Round-the-Clock Monitoring

CERT-In has told at-risk firms to "treat this campaign as active and escalating." The agency urged companies to monitor their systems around the clock, and advised firms to add staff and lower alert thresholds during holidays, weekends and other periods of reduced coverage. The staffing guidance tracks directly with CERT-In's finding that the group "operates at machine speed" and has timed strikes for periods when monitoring is thinnest.

This article originally appeared on CoinCentral.