India Says AI Hackers Hit Crypto Exchanges at Machine Speed. The 6-Hour Rule Is the Real Story.

Somewhere right now, a server is being probed. Then probed again. Then ten thousand more times, in the time it takes a human analyst to finish a coffee.

That's the picture India's national cyber agency put on the record in a new advisory. CERT-In, the government unit that runs incident response for the country, says a threat actor is pushing an AI-assisted hacking campaign against crypto exchanges and other financial firms. The phrase it chose was "machine speed."

Look, AI hacking isn't a new idea. Models have been writing phishing copy and fuzzing endpoints for a couple of years now. What's different is that a major government has now described the threat velocity, not just capability. That's a signal about where the damage is actually happening.

What India flagged

The short version: an active threat actor, AI tooling in the loop, crypto exchanges and financial firms as targets, and a tempo that outruns normal human response cycles. CERT-In didn't frame this as a single breach or a single victim. It framed it as a campaign. That's the word that should make security teams sit up.

A campaign means persistence. It means someone is running reconnaissance around the clock, testing endpoints, mapping employee behavior, reading public code repos, and letting software decide where to push next. In simple terms, the attacker built a pipeline and pointed it at the industry.

India is a reasonable place for that warning to originate. The country runs some of the highest retail crypto volumes in Asia, hosts a deep pool of exchange engineering talent, and has spent the past few years tightening its reporting rules for financial firms. When CERT-In talks, Indian exchanges listen. Increasingly, so does everyone else.

The part nobody wants to price in

Here's why the plumbing matters. AI didn't invent a single new vulnerability class. What it did was demolish the labor cost of trying. A decent penetration tester runs six figures a year and needs sleep. A model chewing through exploit attempts costs pennies an hour. When the cost per attempt drops to near zero, the whole risk math for a mid-tier exchange changes.

Because the attacker doesn't need to be smarter than your security team. They just need more swings than you've analysts.

Think of it this way: crypto exchanges live in a world with irreversible finality. There's no chargeback, no card network to call, no reversal window. A bank that gets hit eats a loss and moves on. An exchange that gets hit has customer funds gone the moment the block confirms. So the tolerance for a slow detection cycle is near zero, and the entire industry knows it.

Now stack that against the six-hour incident reporting requirement India put in place back in 2022. Firms operating in the country are expected to flag cyber incidents to CERT-In within six hours. That's an aggressive clock even by global standards. And it's brutal when your detection stack still depends on someone waking up.

So what does a 40-person exchange do when the attacker iterates faster than its on-call rotation?

Mostly, it hopes. That's not a strategy, but it's what the market currently funds.

Who wins, who gets squeezed

The big exchanges come out of this fine, and probably stronger. Coinbase, Binance, Kraken, OKX, the tier that can staff a security operations center with a hundred people and buy every threat intel feed on the shelf. For them, security quietly becomes the moat. Not listings. Not fees. The ability to say, credibly, that we can absorb machine-speed attacks without losing your bitcoin.

The squeeze lands on the middle. The 200-person exchange with real volume and a real user base but a security budget that tops out at a handful of engineers. They can't out-hire this. They can only out-architect it, and architecture takes time they don't have.

Which means the next consolidation wave in crypto won't be driven by regulation or token listings. It'll be driven by security budgets. That's my first hot take, and I'll defend it: within two cycles, the number of exchanges that can plausibly guarantee institutional-grade custody will be small enough to count on your hands.

The second one is less comfortable. Most of the AI risk here's being sold as a technology problem when it's really a process problem. Detection that takes 40 minutes and a Slack ping is the actual vulnerability. Models just made it visible faster. If your logs don't write their own incident report in six hours, the AI isn't the thing that failed you.

And yes, the usual suspects benefit from all of this. North Korea's Lazarus Group has been running crypto theft as a state program for years, and AI tooling compresses their research cycle too. Sanctions haven't slowed them. Better defenses might.

What to actually take from this

For everyday users, nothing changes overnight. Your exchange either has a security operations function that runs 24/7 or it doesn't. You just can't see which from the app.

So here's the concrete take. Stop evaluating exchanges on fee schedules and listing speed. Those are marketing. Ask a harder question: how many security engineers do you employ, and how fast does your median detection-to-containment cycle run? Most won't answer. The ones that do are telling you something real.

And if you're holding more than a few months of savings on a centralized venue, move it. Not because an AI is coming for your specific account. Because the reporting clock is now six hours, the attacker's cycle is minutes, and the only party that reliably eats the difference is you.

The exchange that survives the next cycle won't be the one with the best token list. It'll be the one whose infrastructure noticed the breach before a regulator did.