India warns AI-assisted hackers are stealing crypto wallet keys

India’s Computer Emergency Response Team, CERT-In, has issued a critical warning about escalating AI-assisted attacks on banking, financial services and insurance entities, including repeat targeting after incomplete remediation. Its Nov. 4 CRAFTY FALCON advisory describes an ongoing campaign that abuses financial institutions’ own cloud services and payment interfaces to move funds.

Cryptocurrency exchanges and virtual digital asset service providers are among the affected categories. CERT-In reports stolen wallet keys and funds siphoned from cryptocurrency wallets, placing crypto custody within a broader warning that also covers non-bank financial companies, digital lending platforms, fintech firms and payment providers. The public advisory does not name an affected exchange or quantify the losses.

The notice updates CERT-In’s Oct. 9 advisory on unauthorized fund transfers through payment and disbursement APIs, the interfaces applications use to request those transactions. @IndianCERT announced the new advisory on Nov. 4. The agency says its finance response team, CSIRT-Fin, has designated the actor behind the campaign CRAFTY FALCON.

CERT-In says it continues to receive reports of successful attacks involving NBFCs and fintech entities that had received earlier restricted warnings and undertaken remediation. It specifically identifies re-targeting after incomplete remediation, with attacks timed for holidays, weekends and other periods of reduced monitoring.

How the campaign reaches financial systems

CERT-In describes several routes through institutions’ infrastructure. Internet-facing testing and staging environments have provided entry points, followed by access to production systems through shared credentials, tokens or network connections. Modified application packages have also been used to initiate unauthorized API calls, defeating controls that assumed requests would come only from the legitimate application.

Cloud management channels are another reported avenue. The advisory says services including AWS Systems Manager and Lambda were abused to execute commands and deploy malicious files, allowing hostile activity to blend into legitimate administration.

Even restricting access to approved IP addresses can leave an opening. CERT-In says attackers originated traffic from shared third-party fetcher pools that institutions had allow-listed. It recommends replacing that reliance with controls that authenticate the requesting party, such as mutual TLS, cryptographically signed requests or scoped API keys on dedicated vendor endpoints.

The agency also describes micro-value test transactions, such as one rupee, used to check unauthorized fund flows before larger transfers. Merchant settlement APIs used by payment aggregators were exploited or abused as well.

CERT-In attributes the campaign’s AI assistance to its incident analysis. It identifies publicly available offensive-security tools including ARTEX, PentAGI, Cairn and CyberStrikeAI, alongside rapid production of tailored scripts and payloads that adapt to target responses. Those descriptions are the agency’s assessment of the activity.

Payment authorization and wallet keys need separate protections, alongside verified eradication and continuous monitoring.

The public advisory names no affected exchange and quantifies no losses. The wallet-key route is shown separately; no common intrusion path, exhaustive attack sequence or protection guarantee is inferred.

Sources and evidence

Sources

1. CERT-In CIAD-2026-0058, Nov. 4, 2026

Supporting facts

• CERT-In issued critical advisory CIAD-2026-0058 on Nov. 4, 2026, updating its Oct. 9 advisory on unauthorized fund transfers through payment and disbursement APIs in banking, financial services and insurance entities. [1]
• CERT-In reports that cryptocurrency exchanges and virtual digital asset service providers were targeted, with wallet keys stolen and funds siphoned from cryptocurrency wallets. [1]
• CERT-In says exposed testing and staging systems provided entry points into production through shared credentials, tokens or network paths, while modified application packages were used to initiate unauthorized API calls. [1]
• CERT-In describes small test transactions, such as one rupee, used to validate unauthorized fund flows before larger transfers, and abuse of merchant settlement APIs. [1]
• CERT-In says attacks have been timed for holidays, weekends and low-monitoring periods, and recommends heightened round-the-clock monitoring, forensic verification of eradication and continued threat hunting. [1]
• CERT-In recommends isolating non-production from production, enforcing server-side transaction validation and request signing, restricting cloud privileges, rapidly patching exposed applications and monitoring small-test-then-large-transfer patterns. [1]
• For cryptocurrency wallet protection, CERT-In recommends hardware security modules or cold custody, multi-signature withdrawal approvals, anomaly monitoring and immediate key rotation on suspected compromise. [1]

Method

Selected reported relationships are mapped from the advisory. Arrows summarize described access and fund-flow patterns, not a complete reconstruction of every incident. Blue annotations are recommendations, not observed outcomes or measured effectiveness.

Scope

The public advisory names no affected exchange and quantifies no losses. The wallet-key route is shown separately; no common intrusion path, exhaustive attack sequence or protection guarantee is inferred.

Infographic by CryptoSlate

CERT-In calls for heightened round-the-clock monitoring, with more coverage during weekends, holidays and other periods when an attack could go unnoticed longer.

For institutions recovering from an incident, the advisory recommends forensic verification that the intrusion has been eradicated, followed by continued threat hunting.

The technical controls include separating testing environments from production, restricting cloud privileges, rapidly patching exposed applications and enforcing transaction rules on the server. Signed API requests add another check on whether a payment instruction should be accepted.

Transaction monitoring should also connect small test payments with subsequent high-value transfers.

Protecting crypto wallet keys

For crypto service providers, CERT-In recommends storing wallet keys in hardware security modules or cold custody, requiring multi-signature approvals for withdrawals and monitoring withdrawal patterns for anomalies. Keys should be rotated immediately when compromise is suspected.

CERT-In says it has shared the full indicators of compromise, infrastructure fingerprints and detection rules with BFSI entities through restricted advisories. Its public warning cautions against limiting the response to blocking indicators, alongside its recommendations for continued threat hunting and verified eradication.