AI-Steered Hacker Group CRAFTY FALCON Drains Crypto Wallets and Fintech APIs, CERT-In Flags

Wallet keys have been stolen from crypto exchanges by an AI-assisted hacker group, according to India's cyber agency CERT-In. The same group has also initiated unauthorized transfers via fintech payment systems.

The agency rated its November 4 warning as Critical and identified the actor as CRAFTY FALCON. Financial firms continue to report successful attacks, CERT-In stated.

CRAFTY FALCON Exploits Firms' Own Systems

Funds are moved through victims' own payment application programming interfaces (APIs), according to CSIRT-Fin, CERT-In's finance unit.

The attackers send small test amounts, such as Rs. 1, before executing larger transfers to confirm the route is functional. Crypto exchanges and virtual digital asset service providers are also on the target list.

According to the advisory, attackers stole wallet keys from these platforms and removed funds from their crypto wallets. CERT-In has not named any affected firm or disclosed the total amount lost.

Publicly available AI tools, including PentAGI and CyberStrikeAI, were found in the attacks. The agency says these tools run complete attack chains automatically and adjust their payloads as targets respond.

Furthermore, the group returned to some non-banking financial companies (NBFCs) and fintechs that had already acted on earlier restricted warnings. Attacks were also timed for holidays and weekends, when fewer staff monitor systems.

Diwali is not explicitly mentioned in the advisory. However, the festival occurs on Sunday, November 8, which falls on both a holiday and a weekend. CERT-In recommends that firms increase staffing and lower alert thresholds during such windows.

Who Bears the Loss When an Exchange Wallet Is Drained

Loss figures are not included in the public advisory, but previous exchange breaches show how such losses were handled.

In July 2024, hackers stole more than $230 million from Indian exchange WazirX. The exchange resumed operations in October 2025 under a Singapore court-approved restructuring. Eligible users then received about 85% of their approved claims.

In contrast, Binance said it covered about 95% of its $6.3 billion loss on October 29 from its own reserves.

CERT-In asks crypto platforms to store wallet keys in hardware security modules or cold custody. It also wants multi-signature approval for crypto withdrawals and cooling periods for new beneficiaries across all payment systems.

Multi-signature approvals and cooling periods introduce additional verification before money is transferred, which could slow some withdrawals and payouts.

CERT-In has shared its full indicators of compromise only with financial firms, in a restricted version of the advisory. Disclosures from affected lenders or exchanges would reveal the total amount taken by CRAFTY FALCON.