CERT-In Says AI-Assisted Attacks Stole Cryptocurrency Exchange Keys

The Indian Computer Emergency Response Team (CERT-In) identified CRAFTY FALCON as a threat actor in an active AI-assisted campaign targeting cryptocurrency exchanges, where wallet keys were stolen and funds siphoned from wallets.

CERT-In described intrusions through internet-exposed testing or staging systems, followed by moves into production through shared credentials, tokens or network paths. The agency also described attackers reverse-engineering application code and modifying packages to make unauthorized API calls.

Attackers used Rs. 1 transactions to test unauthorized fund flows before larger transfers. The campaign also involved abuse of payment aggregators’ merchant settlement APIs.

CERT-In said it received reports of fresh attacks on nonbank lenders and fintech firms that had acted on earlier restricted advisories. Some were targeted again after incomplete remediation; CERT-In did not identify cryptocurrency exchanges as repeat targets.

CERT-In recommended round-the-clock monitoring, additional staffing and lower alert thresholds during weekends, holidays and other periods with limited coverage.