CRAFTY FALCON is targeting crypto platforms with machine-speed attacks, using AI-driven tools to execute tailored exploits and steal digital assets.
India’s Computer Emergency Response Team (CERT-In) has warned that an AI-assisted financial threat actor named CRAFTY FALCON is actively targeting banks, fintech companies, payment service providers, as well as cryptocurrency exchanges, stealing wallet keys and siphoning funds.
According to CERT-In, the campaign has continued despite earlier warnings and remediation efforts. Affected entities, including non-banking financial companies (NBFCs) and fintech firms, have reported successful attacks.
Funds At Risk
The threat actor has been deliberately re-targeting entities that had already received restricted advisories, especially where remediation was incomplete. Attacks have also been timed to coincide with holidays, weekends, and other periods of low monitoring, which has delayed detection and response.
CERT-In describes CRAFTY FALCON as a threat actor that surveys targets using machine intelligence, operates at machine speed, and exploits the victim’s own payment and disbursement APIs to move funds. The investigation has identified the use of publicly available AI-driven offensive security tools, including the ARTEX family of large language model-based tools, the PentAGI autonomous multi-agent AI penetration testing system, the Cairn attack search engine, as well as the CyberStrikeAI framework.
These tools can execute attack chains autonomously, generate and refine large numbers of tailored scripts, and adapt their payloads based on target responses. The attack pattern includes targeting cloud infrastructure, abusing management services such as AWS Systems Manager and Lambda to execute commands and deploy malicious files, and using internet-exposed testing and staging environments as entry points into production systems.
Attackers have also been found to have reverse-engineered application codebases to develop tailored exploits and initiated unauthorized API calls through modified application packages. CERT-In has identified attempts to bypass IP allow-listing by using whitelisted third-party fetcher IP pools. In some cases, attackers have carried out micro-value test transactions, such as 1 INR ($0.011), to validate unauthorized fund flows before executing larger transfers.
AI Security Challenges
Several prominent figures have explicitly warned about artificial intelligence being weaponized to attack crypto exchanges and digital assets. Following the catastrophic $6.3 billion hack on Binance, Musk said that “super intelligence agents will at some point do this to gain currency for themselves, not a human.” Meanwhile, Trace Finance co-founder Bernardo Brites said,
You may also like:
“AI tools can now find vulnerabilities faster than teams can patch them, which is why we’ve seen a string of major incidents in recent months.”
