India's national cybersecurity agency has issued a formal warning to cryptocurrency exchanges and financial institutions, alerting them to an escalating AI-assisted hacking campaign that exploits weaknesses in cloud infrastructure, payment APIs, and software environments to steal wallet keys and siphon funds from affected platforms.

The Indian Computer Emergency Response Team (CERT-In), the government agency responsible for responding to cybersecurity incidents and operating under India's Ministry of Electronics and Information Technology, identified the threat actor behind the campaign as CRAFTY FALCON. In its advisory, CERT-In named four AI-assisted offensive-security tools used in the attacks: ARTEX, PentAGI, Cairn, and CyberStrikeAI.

According to the agency, the tools automate reconnaissance, generate customized attack scripts, and adapt their techniques in real time based on how targeted systems respond — capabilities that allow hackers to execute attacks at machine speed.

Exploited Weaknesses

CERT-In identified several vulnerabilities being exploited in the course of the campaign. According to the advisory, these include:

• Exposed testing environments connected to production systems
• Stolen credentials
• Misconfigured cloud services
• Payment APIs that accept unauthorized requests

Test environments typically carry lighter security controls than production systems, so any connection between the two can serve as a stepping stone into live infrastructure. The advisory further describes how attackers use small test transactions — in some cases worth just one rupee — to establish whether fraudulent transfers will succeed before they attempt larger withdrawals. CERT-In also noted that some attacks are deliberately timed for weekends and holidays, when security monitoring may be reduced.

Targets and Impact

The campaign has reportedly targeted cryptocurrency exchanges and virtual digital asset service providers, resulting in the theft of wallet keys — the cryptographic credentials that control access to digital asset holdings — and the draining of funds. Under Indian regulation, virtual digital asset is the umbrella term for cryptocurrencies and comparable tokens, putting the advisory squarely within the remit of the country's crypto-asset sector. Unlike a compromised password, a stolen wallet key cannot simply be reset, and transfers already executed with it cannot be reversed by the holder — which is why the advisory's guidance leans heavily on prevention. CERT-In did not identify the affected exchanges or disclose the scale of losses.

CERT-In's Recommendations

For institutions recovering from an incident, the advisory recommends conducting forensic checks to confirm that the intrusion has been completely eradicated, followed by continued threat hunting.

To counter the threat, CERT-In recommends that crypto service providers:

• Store wallet keys in hardware security modules — tamper-resistant devices built to generate and safeguard cryptographic keys — or in cold storage, which keeps keys fully offline and out of reach of internet-connected systems
• Require multi-signature approvals for withdrawals, so that no single key can move funds on its own
• Monitor withdrawal patterns for unusual activity

Keys should be rotated immediately if a compromise is suspected.

More broadly, the warning highlights a growing security challenge for crypto businesses, as AI lowers the technical barriers to discovering and exploiting infrastructure weaknesses, automates attacks, and scales operations across multiple targets at once. CERT-In's guidance calls for stronger cloud and API security, continuous monitoring, hardware-based key protection, cold storage, and multi-signature withdrawal approvals for institutions and service providers across the digital asset sector.

Source: BitcoinKE, November 6, 2026 — India Reveals How AI Hacks Are Happening