CERT-In Issues Urgent Alert on AI-Assisted CRAFTY FALCON Crypto Hacks
Key Summary
India's computer emergency response agency warns that autonomous AI threat actor CRAFTY FALCON is targeting cryptocurrency exchanges, payment gateways, and fintech platforms by weaponizing machine intelligence and cloud management tools to drain corporate and client funds.
Key Bullets
- India cybersecurity monitors warn that an AI-assisted threat actor designated as CRAFTY FALCON is actively compromising crypto exchanges and fintech disbursement networks.
- Investigators discovered attackers weaponizing autonomous offensive engines such as the ARTEX toolkit and the PentAGI multi-agent penetration framework against staging environments.
- Malicious operators bypass IP allow-lists using third-party fetcher pools and validate stolen fund routing channels by executing micro-value test transactions worth $0.011.
- Industry executives note that automated offensive tools discover target code vulnerabilities faster than engineering teams can deploy manual security patches.
CERT-In Flags Autonomous AI Exploit Campaign
India's Computer Emergency Response Team issued a formal threat advisory confirming that an AI-assisted financial threat group known as CRAFTY FALCON is successfully breaching cryptocurrency exchanges, payment gateways, and digital asset custodians. Public advisories confirm the threat group deliberately timed intrusions to coincide with weekends, holidays, and low-monitoring windows to minimize early operational resistance.
Investigators traced the intrusions directly back to unpatched cloud vulnerabilities and exposed testing environments. Exchange security teams faced rapid automated ingress movements. The operational tempo overwhelmed standard incident response timelines across multiple regional jurisdictions.
Machine Intelligence Deployed Against Payment APIs
Forensic analysis confirms the threat actor relies on publicly available machine learning offensive frameworks, including the ARTEX large language model suite and the PentAGI autonomous penetration testing system. These architectures map target enterprise perimeters, reverse-engineer application codebases, and write bespoke exploit payloads in real time.
Attackers leverage compromised cloud management services, including AWS Systems Manager and Lambda functions, to execute malicious command sets directly inside production systems. Unauthorized API calls target internal disbursement mechanisms to drain assets while bypassing perimeter defenses.
Intrusion vectors routinely bypass traditional IP allow-listing controls by routing traffic through whitelisted third-party fetcher IP pools. Before executing large-scale capital exfiltration, operators execute micro-value test transactions, such as 1 INR ($0.011), to confirm API routing integrity.
Industry Leaders Warn of Escalating AI Threats
Industry executives highlight the widening operational asymmetry between automated offensive tooling and manual defensive engineering cycles. Trace Finance co-founder Bernardo Brites noted that automated intelligence engines locate code flaws faster than human patch teams can deploy fixes. The structural vulnerability gap has triggered a string of severe platform compromises.
Following previous high-profile platform incidents, industry figures warned that autonomous systems will increasingly target decentralized networks and centralized exchanges to accumulate financial capital independently. Cybersecurity budgets must adapt immediately to machine-speed threat vectors.
About CryptoNewsFree Market Intelligence Wire
The CryptoNewsFree Market Intelligence Wire provides rapid, objective coverage of breaking crypto developments, regulatory actions, and market liquidity trends. Our reporting strictly follows our Editorial & Verification Standards.