India’s cyber agency CERT-In says an AI-assisted hacker group has stolen wallet keys from crypto exchanges. The same group is triggering unauthorized transfers through fintech payment systems.
CERT-In rated its November 4 warning Critical and named the actor CRAFTY FALCON. The agency says financial firms continue to report successful attacks.
How CRAFTY FALCON Turns Firms’ Own Systems Against Them
CSIRT-Fin, CERT-In’s finance unit, says the group moves money through victims’ own payment application programming interfaces (APIs).
Before large transfers, the attackers send small test payments, such as Rs. 1, to check that the route works. Crypto exchanges and virtual digital asset service providers are also on the target list.
According to the advisory, attackers stole wallet keys from these platforms and took funds from their crypto wallets. However, CERT-In does not name any affected firm or disclose how much was lost.
The agency found publicly available AI tools in the attacks, including PentAGI and CyberStrikeAI. It says these tools run full attack chains on their own and adjust payloads as targets respond.
Moreover, attackers returned to some non-banking financial companies (NBFCs) and fintechs that had already acted on earlier restricted warnings. They also timed raids for holidays and weekends, when fewer staff watch systems.
CERT-In does not mention Diwali. However, the festival falls on Sunday, November 8, making it both a holiday and a weekend day. The agency wants firms to add staff and lower alert thresholds during such windows.
Follow us on X to get the latest news as it happens
Who Pays When an Exchange Wallet Is Drained
The public advisory does not include loss figures, but past exchange breaches show how such losses have been handled.
In July 2024, hackers took more than $230 million from Indian exchange WazirX. The exchange restarted in October 2025 under a Singapore court-approved restructuring. Eligible users then received about 85% of their approved claims.
In contrast, Binance said it covered about 95% of its $6.3 billion October 29 loss from its own reserves.
CERT-In asks crypto platforms to store wallet keys in hardware security modules or cold custody. It also wants multi-signature approval for crypto withdrawals, and cooling periods for new beneficiaries across all payment systems.
Multi-signature approvals and cooling periods add checks before money moves, which could slow some withdrawals and payouts.
CERT-In has shared its full indicators of compromise only with financial firms, in a restricted version of the advisory. Disclosures from affected lenders or exchanges would show how much CRAFTY FALCON has taken.
Subscribe to our YouTube channel to watch leaders and journalists provide expert insights
