India's cyber agency CERT-In issued a critical warning on November 4 about an AI-assisted hacker group called CRAFTY FALCON that has stolen wallet keys from crypto exchanges and triggered unauthorized transfers through fintech payment systems.
The group uses publicly available AI tools including PentAGI and CyberStrikeAI to run full attack chains that adjust payloads as targets respond. Before large transfers, attackers send small test payments, such as Rs. 1, to verify payment routes work. CRAFTY FALCON moves stolen funds through victims' own payment application programming interfaces.
CERT-In says the group has targeted crypto exchanges, virtual digital asset service providers, and non-banking financial companies. Financial firms continue to report successful attacks. The agency found that attackers timed raids for holidays and weekends when fewer staff monitor systems. CERT-In did not name any affected firms or disclose total losses.
The agency recommended crypto platforms store wallet keys in hardware security modules or cold custody, require multi-signature approval for withdrawals, and implement cooling periods for new beneficiaries. It shared a restricted version of the advisory with financial firms only, containing full indicators of compromise.
Past breaches provide context on losses. In July 2024, hackers took more than $230 million from Indian exchange WazirX. The exchange restarted in October 2025 under restructuring and eligible users received about 85% of their approved claims. Binance said it covered about 95% of its $6.3 billion October 29 loss from its own reserves.