India warns of CRAFTY FALCON, an AI-assisted campaign also targeting crypto platforms

A financial warning that includes crypto businesses

CERT-In, India’s computer emergency response agency, published a critical advisory on November 4 about an AI-assisted financial attack campaign. Its specialist CSIRT-Fin team calls the actor CRAFTY FALCON. The advisory explicitly includes cryptocurrency exchanges and virtual digital asset service providers, alongside fintech companies, digital lenders and payment businesses. It describes the threat as active and ongoing, without publicly identifying an affected crypto platform or quantifying its losses.

The publication updates an earlier October 9 warning. According to the agency, some organizations that had already been notified and started fixes were attacked again after incomplete remediation. Periods of reduced monitoring, including weekends and holidays, are among the targeted windows. For readers, this means an announced fix does not by itself establish that an incident has ended. The observation concerns the campaign CERT-In describes; it does not support attributing every recent financial attack to this actor.

Technical access matters as much as wallets

The advisory links intrusions to test environments inadequately separated from production, shared credentials and abuse of cloud tools or application interfaces. It also describes theft of crypto wallet keys. The agency observes script variants rapidly adapted to system responses, behavior it associates with AI tools. The issue therefore extends beyond smart contracts: administrative access, applications and payment services can expose funds before a transfer ever reaches a blockchain.

CERT-In calls for stronger continuous monitoring, separation of technical environments and access rights limited to actual needs. For payments, it recommends server-side validation and monitoring unusual transactions, including small transfers to a new beneficiary followed by large ones. These controls complement each other. An approved network address alone does not prove that an instruction comes from the correct user or that a transaction follows the service’s rules.

Remediation needs continuing verification

For crypto businesses, recommendations include hardware protection or cold custody for keys, multiple signatures for withdrawals and anomaly detection. They do not guarantee against loss. Following a suspected compromise, the agency calls for preserving logs and evidence, isolating affected systems and rotating exposed credentials. Verification needs to establish that the attacker’s access has been removed, followed by periodic searches for signs of continued presence.

The public advisory does not include all detailed technical indicators, which were shared with relevant organizations through restricted channels. It nevertheless delivers a clear operational message: blocking a few addresses or fixing one weakness may leave other access routes intact. For users, the notice proves neither a general platform outage nor compromise of their account. It documents a specific campaign and emphasizes operators’ responsibility for protecting infrastructure and transfer procedures.