# CERT-In Says AI-Assisted Attacks Stole Cryptocurrency Exchange Keys

By Simon Yoon

Canonical URL: https://www.tokenpost.com/news/technology/50147
Published: 2026-11-06T14:28:20.000Z
Updated: 2026-11-06T14:28:20.000Z
Section: Technology

> Repeat attacks involved nonbank financial companies and fintech firms, with some targeted again after incomplete remediation. CERT-In did not identify exchanges among the repeat targets.

The Indian Computer Emergency Response Team (CERT-In) identified CRAFTY FALCON as a threat actor in an active AI-assisted campaign targeting cryptocurrency exchanges, where wallet keys were stolen and funds siphoned from wallets.

CERT-In described intrusions through internet-exposed testing or staging systems, followed by moves into production through shared credentials, tokens or network paths. The agency also described attackers reverse-engineering application code and modifying packages to make unauthorized API calls.

Attackers used Rs. 1 transactions to test unauthorized fund flows before larger transfers. The campaign also involved abuse of payment aggregators’ merchant settlement APIs.

CERT-In said it received reports of fresh attacks on nonbank lenders and fintech firms that had acted on earlier restricted advisories. Some were targeted again after incomplete remediation; CERT-In did not identify cryptocurrency exchanges as repeat targets.

CERT-In recommended round-the-clock monitoring, additional staffing and lower alert thresholds during weekends, holidays and other periods with limited coverage.