# India's CERT-In Warns Crypto Firms of Active CRAFTY FALCON Attacks

By Simon Yoon

Canonical URL: https://www.tokenpost.com/news/technology/50872
Published: 2026-11-07T14:23:48.000Z
Updated: 2026-11-07T14:23:48.000Z
Section: Technology

> The campaign targets financial firms, abuses payment APIs and uses public AI-driven tools to tailor attacks.

India's Computer Emergency Response Team (CERT-In) warned that an active campaign called CRAFTY FALCON is targeting crypto exchanges and other financial firms to steal wallet keys and move funds.

The agency said the campaign has continued despite earlier warnings and remediation efforts. Some nonbank financial companies and fintech firms have reported successful attacks; banks, payment service providers and crypto exchanges are also listed as targets.

CRAFTY FALCON uses publicly available AI-driven security tools to scan targets, generate tailored scripts and adjust attack code in response to system behavior, CERT-In said. The tools can execute attack sequences autonomously.

Attackers have abused victims' payment and disbursement APIs, cloud services such as AWS Systems Manager and Lambda, and internet-exposed test or staging systems to reach production environments, the agency said.

CERT-In said some attacks tested unauthorized fund transfers with very small transactions before moving larger sums. The agency also identified attempts to bypass IP allow lists by routing requests through whitelisted third-party fetcher IP pools.