CERT-In Flagged an AI Hacker Crew. India's Crypto Exchanges Should Be Nervous.
India's cyber agency rated a November 4 warning Critical and named the actor CRAFTY FALCON. The group is stealing wallet keys from crypto exchanges and pushing unauthorized transfers through fintech payment rails, and firms are still reporting successful hits. The asymmetry here's ugly: one AI-assisted crew versus hundreds of small, understaffed targets.
I read the CERT-In advisory twice. Not because it was complicated. Because it wasn't.
India's cyber agency dropped a Critical-rated warning on November 4, and it named the actor. CRAFTY FALCON. AI-assisted. And per CERT-In, financial firms are still reporting successful attacks weeks later.
That last bit is the story. Not the name. The "still."
Inside The Attack
Here's what most coverage glides past. This isn't one playbook. It's two, running off the same tooling.
Play one targets crypto exchanges. The crew is going after wallet keys, meaning the seed phrases and private keys that live in hot wallet infrastructure and, probably, on somebody's laptop. Once you've keys you don't need an exploit. You just sign the transaction and walk out.
Play two hits fintech payment systems. Unauthorized transfers, per the advisory. That's the scarier half. Payment rails are supposed to be the audited, locked-down, boring part of the stack.
And the "AI-powered" label isn't marketing fluff. It reads like automated recon at scale, faster phishing lures, and models working out which employee, endpoint, or API call gets you inside. The machine doesn't get tired. It doesn't need sleep at 3am.
Why It Matters
India is one of the biggest crypto markets on the planet by adoption. Hundreds of exchanges, wallet apps, payment firms, lending desks. Most of them small.
So ask yourself honestly. How many of those shops have a security team bigger than four people? Anon, let me explain. Almost none.
That's the asymmetry, and it's brutal. One AI-assisted crew can run a hundred small targets at once. Each target only needs one tired engineer to click one link.
The crypto side compounds it. A stolen key isn't a bug you patch. It's a signature. It looks legitimate because it's legitimate. Any exchange holding client funds in a setup where a single phished credential can move a hot wallet is one bad Tuesday away from a headline.
Real talk: if one password can drain your hot wallet, you don't have a security program. you've a hope.
What I'd Actually Do
If you hold coins on an Indian exchange, this is your nudge.
Move the long-term bags to self-custody. Keep only trading size on the platform. Turn on every second factor it offers, ideally a hardware key, not SMS. Those three moves kill most of what CRAFTY FALCON is doing to retail accounts.
If you run one of these firms, stop treating key management as an IT ticket. Multisig. MPC. Hardware modules. Approval thresholds so no single credential can move size. None of that's exotic anymore. It's table stakes.
What I'm watching next. First, whether CERT-In publishes indicators of compromise or keeps the advisory vague. Second, whether the RBI and SEBI follow with mandatory audits for payment and exchange operators. Third, and this is the one that tells us the real damage, on-chain outflows from Indian exchange wallets over the next 30 days.
The chain doesn't lie. If CRAFTY FALCON is landing hits, the wallets will show it long before any press release does.
