CRAFTY FALCON is the name India’s cyber agency CERT-In has given to an AI-aided hacker that is now going after crypto exchanges and other money firms, as a critical rated alert from Nov 4 sho
CRAFTY FALCON is the name India’s cyber agency CERT-In has given to an AI-aided hacker that is now going after crypto exchanges and other money firms, as a critical rated alert from Nov 4 shows.
The alert says the hacker works at machine speed and strikes by using a victim’s own payment tools. It also says the attacks are still going on.
The finance response team at CERT-In gave the hacker its name in alert CIAD-2026-0058, which builds on a first warning from Oct 9. The new text says a closer look at reports from hit firms showed a big rise in attacks.
The targets include lenders, fintech firms, payment companies, and crypto exchanges. The warning also calls the exchanges virtual digital asset firms.
The warning says the hacker scans its targets with smart tools. It then uses the victim’s own payment links, known as APIs, to move money out. Several public AI tools are named in the alert, such as ARTEX, PentAGI, Cairn, and CyberStrikeAI. The systems behind the attacks also change their IP addresses every few hours or days, which makes them hard to block.
Exchanges run the same kind of payment tools as lenders, so they are an easy target for this kind of attack. The warning lists crypto exchanges among the firms that were hit. Some attacks were timed for holidays and weekends, when teams watch their systems less closely.
Some firms that had fixed the first holes were hit again because the fixes were not complete. The public reports reviewed do not name any exchange and do not give loss figures.
An AI tool can test a system and try new ways much faster than a person can. That speed means a small gap can be found and used before a team has time to react. For this reason the warning tells all finance firms to treat the threat as urgent and lasting. It also asks them to check that every old fix is truly done.
The alert is written for firms, but users can still take simple steps. Turn on two-step login and add a list of safe withdrawal addresses if your exchange offers one. Give API keys only the power they need. Never share a wallet key or seed phrase with anyone. Watch the official pages of your exchange for notices, since a firm under attack may pause some services.
This update was also informed by the organization through the official X account.
More updates are likely, so three things are worth watching in the coming days. The first is a new version of the alert, the second is a word from the exchanges, and the third is fresh crypto news on losses or arrests.
Follow theCERT-In site for the latest. The story of CRAFTY FALCON is still moving, so every detail here could change.
YMYL Disclaimer: This article is for information only and is not financial, investment, or legal advice. Crypto assets are volatile, so always check official sources first.
