India’s national cybersecurity agency has a new warning about AI hackers, and it lands squarely on the crypto industry’s doorstep. A CERT-In advisory issued through its financial-sector arm CSIRT-Fin on November 4 flags an active, escalating campaign tracked as CRAFTY FALCON — and for the first time, cryptocurrency exchanges and virtual digital asset service providers appear explicitly among the targets.
CERT-In’s own phrasing is the kind you read twice: CRAFTY FALCON “surveys its targets with machine intelligence, operates at machine speed and strikes by invoking the victim’s own payment and disbursement APIs.” For AI hackers targeting crypto exchanges, the pitch is no longer experimental — it is industrialized.
Meet CRAFTY FALCON
The November advisory updates an earlier warning from October 9, 2026, and broadens it. Previously restricted to non-bank financial companies, digital lending platforms, fintechs and payment aggregators, the campaign now names crypto exchanges alongside those financial firms. CSIRT-Fin says it continues to receive reports of successful attacks against entities that had already received the earlier restricted advisory — meaning the first warning was not enough.
The AI tooling: ARTEX, PentAGI, Cairn and CyberStrikeAI
CERT-In identified four tools in the campaign’s kit: ARTEX (LLM-based offensive tooling), PentAGI (autonomous multi-agent penetration testing), Cairn (an attack search engine) and the CyberStrikeAI framework. The actors use AI to rapidly generate and refine attack scripts, reverse-engineer application code for tailored exploits, and move from reconnaissance to payload faster than a human team could schedule the standup.
This is not the first time ARTEX has surfaced. In October, CrowdStrike reported an attacker using ARTEX alongside Claude Code and other AI models to breach South Korean financial firms — the same playbook, now aimed partly at exchanges.
How the attacks actually land
The tradecraft is patient and unpleasantly practical: exploit vulnerable applications and exposed testing environments, ride shared credentials and access tokens into production, and deploy malicious files in cloud infrastructure. Once inside, the attackers invoke the victim’s own payment and disbursement APIs, run small test transactions to validate unauthorized transfers before moving larger sums, and time their moves for weekends and holidays to delay detection. The stated impact includes stolen crypto wallet keys and funds drained from wallets — though CERT-In named no exchanges and disclosed no loss figures.
What exchanges should do now
CERT-In’s recommendations are unglamorous on purpose: treat the campaign as active and escalating, maintain round-the-clock security monitoring with increased staffing, and lower alert thresholds during holidays, weekends and other low-coverage windows. In other words, the attackers plan their weekends around your staffing rota — and AI hackers only need one window you left open.
Cointelegraph has reached out to CERT-In and major Indian exchanges including CoinDCX, CoinSwitch, WazirX, ZebPay and Mudrex for comment. None of them are publicly saying “we were fine” just yet.
