News · BFSI
India's cyber agency has issued a Critical-rated warning about a hacker group called CRAFTY FALCON that uses publicly available AI tools to steal crypto wallet keys and trigger unauthorised payments through fintech APIs.
✦ AI SUMMARY 30-second read
- CERT-In rated its November 4 advisory Critical and identified the threat actor as CRAFTY FALCON, which uses AI tools PentAGI and CyberStrikeAI to run automated attack chains.
- The group tests payment routes with small amounts such as Rs. 1 before executing large unauthorised transfers through victims' own payment APIs.
- Attackers have stolen wallet keys from crypto exchanges and returned to NBFCs and fintechs that had already responded to earlier restricted warnings.
Why it matters: AI-assisted attacks that adapt in real time and target payment APIs raise the cost and complexity of defence for India's financial sector.
This summary was generated by AI. Editors may review and update it.
India's cybersecurity agency CERT-In has issued a Critical-rated warning about an organised hacker group, designated CRAFTY FALCON, that has been targeting crypto exchanges, virtual digital asset service providers, non-banking financial companies and fintech payment platforms.
CSIRT-Fin, the finance-sector unit of CERT-In, says the group exploits victims' own payment application programming interfaces to move money without authorisation. Financial firms continue to report successful attacks, the agency noted.
The advisory, dated November 4, does not name any affected firm and does not disclose loss figures. Full indicators of compromise have been shared with financial institutions in a restricted version of the warning.
How the attacks work
Before executing large transfers, the group sends small test payments — such as Rs. 1 — to confirm that a payment route is active and functional. Once verified, attackers use the same path to move larger sums.
On crypto platforms, the group has stolen wallet keys and drained funds from exchange wallets. CERT-In found publicly available AI tools, specifically PentAGI and CyberStrikeAI, embedded in the attack chain. These tools are capable of running full attack sequences autonomously and adjusting their approach as targets respond.
CRAFTY FALCON has also returned to NBFCs and fintechs that had already acted on earlier restricted advisories, suggesting the group monitors remediation steps and seeks fresh entry points. Attacks have been timed deliberately for holidays and weekends, when security operations are typically less heavily staffed.
What CERT-In is asking firms to do
The agency wants crypto platforms to store wallet keys in hardware security modules or cold custody, and to require multi-signature approval before any crypto withdrawal is processed.
Across all payment systems, CERT-In recommends introducing cooling periods for newly added beneficiaries. For high-risk windows such as public holidays and weekends, it wants firms to increase monitoring staff and lower alert thresholds.
Multi-signature approvals and cooling periods introduce additional checks before funds move, which could slow some routine withdrawals and payouts as a trade-off for stronger controls.
Past exchange losses as context
While the current advisory carries no loss figures, earlier Indian exchange incidents illustrate the potential scale of such breaches. In July 2024, hackers took more than $230 million from Indian exchange WazirX; the exchange restarted in October 2025 under a Singapore court-approved restructuring, with eligible users receiving about 85 per cent of their approved claims.
By comparison, Binance reported that it covered approximately 95 per cent of a $6.3 billion loss on October 29 from its own reserves. Disclosures from firms currently affected by CRAFTY FALCON would be needed to establish the total amount taken.
What happens next
CERT-In has restricted the full indicators of compromise to financial sector participants. Broader public disclosure of the scale of losses would depend on affected exchanges or lenders making their own announcements.
Elets will update this story as further information becomes available.
