India’s Computer Emergency Response Team (CERT-In) has rated its November 4 warning Critical and identified CRAFTY FALCON as an AI-assisted threat actor targeting cryptocurrency exchanges, virtual digital asset service providers and other financial businesses. The agency says the group has stolen wallet keys and cryptocurrency funds from exchanges, while also triggering unauthorized transfers through victims’ payment application programming interfaces (APIs). Attackers reportedly send small test payments, including Rs. 1, before larger transfers, and continue to target non-bank financial companies (NBFCs) and fintech firms that had already acted on earlier restricted warnings. The campaign exploits poorly secured applications, development and testing environments, shared credentials and access tokens to reach production systems, using publicly available tools including PentAGI and CyberStrikeAI to analyze code, create or alter malicious scripts and adjust payloads as targets respond. Raids have been timed for weekends and holidays, when monitoring staff may be fewer. CERT-In says financial firms continue to report successful attacks but has not named affected organizations or disclosed losses. It recommends hardware security modules or cold custody for wallet keys, multi-signature withdrawal approvals, cooling periods for new beneficiaries, continuous monitoring, extra staffing and lower alert thresholds during low-coverage periods.