India's CERT-In has warned that an AI-assisted hacking campaign is targeting cryptocurrency exchanges and fintech firms, stealing wallet keys and draining funds. Cointelegraph reported the warning on November 5. The agency's November 4 advisory names the threat actor CRAFTY FALCON and rates the threat Critical.
For crypto users in India, the immediate concern is the security of funds entrusted to an exchange. The reported theft of wallet keys puts custody directly at issue: an attacker who reaches the systems controlling assets can threaten balances without first compromising each customer's account.
The public advisory does not name affected exchanges or quantify losses. It warns of a documented campaign without identifying a particular provider or card product as affected.
Attackers reach the systems that move money
CERT-In describes intrusions through exposed testing environments, followed by movement into production through shared credentials or network access. Attackers also abuse cloud management services and invoke victims' payment APIs. The agency reports small test transfers, including transactions of one rupee, before larger unauthorized movements.
An exchange assessing its exposure needs to examine the route between development infrastructure and systems authorized to move funds. A security review concentrated on the customer login screen would leave that route outside its scope.
The small test payment is especially useful as a defensive signal. Its financial value may be negligible, but its purpose is to establish whether an unauthorized instruction succeeds. Treating transaction size alone as the measure of urgency would miss the importance of that first successful instruction.
For customers, this creates a difficult information gap. They can control their passwords and devices, but they cannot personally inspect the internal permissions behind an exchange's withdrawal process. Custody decisions consequently depend partly on a provider's account of its security controls and its handling of incidents.
AI raises the pressure on incomplete repairs
The agency says automated tools generate and revise attack scripts rapidly. It also reports successful attacks against firms that had already attempted remediation, with some operations timed for weekends and holidays. Its recommendations include continuous monitoring, separation of testing from production, and stronger wallet-key protection.
A completed repair therefore needs a precise definition. Restoring a service tells customers that it operates again. Establishing that an intruder's access has been removed answers a separate security question.
AI assistance makes the thoroughness of those repairs more urgent. If attackers can revise their approach quickly, defenders need confidence in the underlying access restrictions. Repeatedly responding to the latest visible attempt would leave the organization dependent on catching the next variation.
For exchange users evaluating an incident statement, useful questions follow from this campaign: which access path was closed, which credentials were replaced, and which controls now restrict fund movements? A statement that answers those questions gives customers more to assess than a general promise of improved security.
Taking custody transfers responsibility
The wallet-key theft reported in the warning gives users a reason to consider self-custody options. Moving assets into a wallet controlled by the user changes who is responsible for protecting the credentials that authorize transactions.
Ethereum.org's security guidance explains the corresponding obligations. A recovery phrase can grant access to all accounts derived from it. A screenshot may expose that phrase through cloud synchronization. Hardware wallets keep private keys offline, while checking transaction details and limiting smart-contract spending permissions address other routes to loss.
Those responsibilities should shape any response to an exchange-security warning. A hurried withdrawal into an unfamiliar wallet can leave the owner managing risks they have not yet understood. Choosing personal custody requires a workable plan for recovery information and transaction approval.
For readers comparing crypto card arrangements, the relevant question is which funds remain under their control and which sit with a provider. The campaign makes the location and control of wallet keys a concrete consideration when deciding where to keep assets intended for later spending.
Overview
CERT-In's warning identifies an active AI-assisted campaign against financial firms, including crypto exchanges, with reported wallet-key theft. Customers should therefore evaluate custody alongside account security. Personal custody transfers key protection to the owner; exchange custody leaves that responsibility with the provider.
