CryptoSlate
India's cybersecurity agency CERT-In has warned that an AI-assisted campaign has stolen wallet keys and siphoned funds from cryptocurrency wallets. Its Nov. 4 advisory identifies crypto exchanges and virtual digital asset providers among the affected categories, alongside banks, fintech firms and other financial businesses. It does not name affected exchanges or quantify losses.
The agency calls the campaign CRAFTY FALCON and says attackers have repeatedly targeted some firms after incomplete remediation. The advisory updates an Oct. 9 warning about unauthorized transfers through payment and disbursement interfaces.
Why it matters
CERT-In says the campaign abuses institutions' own cloud services and payment interfaces to move funds. It has observed attacks during holidays, weekends and other periods of reduced monitoring, including against non-bank financial companies and fintech firms that had received earlier restricted warnings.
The agency's incident analysis attributes AI assistance to the activity, including the rapid creation of tailored scripts and payloads. It recommends verified eradication after incidents, continued threat hunting and stronger transaction controls rather than relying solely on blocking known indicators.
Market impact
The warning places crypto custody within a broader campaign against financial infrastructure, although the public advisory gives no loss figure. For crypto providers, CERT-In recommends hardware security modules or cold custody for wallet keys, multi-signature withdrawal approvals and monitoring for unusual withdrawal patterns. It also calls for immediate key rotation when compromise is suspected.
For financial institutions more broadly, the agency recommends continuous monitoring, separation of testing and production environments, and transaction checks that link small test payments with subsequent large transfers.
Frequently asked questions
-
Which financial businesses are covered by the CERT-In warning?
The advisory includes crypto exchanges and virtual digital asset providers, as well as banks, fintech firms and other financial businesses.
-
Why does CERT-In warn about repeat attacks?
CERT-In says some financial firms were targeted again after incomplete remediation, including during weekends, holidays and other periods of reduced monitoring.
-
How does CERT-In describe AI's role in the campaign?
The agency's incident analysis attributes AI assistance to the activity, including the rapid creation of tailored scripts and payloads.
-
What custody protections does CERT-In recommend?
It recommends hardware security modules or cold custody for wallet keys, multi-signature withdrawal approvals and monitoring for unusual withdrawals. Suspected compromise should prompt immediate key rotation.
-
What should firms do after an intrusion?
CERT-In recommends verifying that the intrusion has been eradicated and continuing threat hunting, rather than relying solely on blocking known indicators.
CoinTelegraph
Crypto Rank News
CoinDesk
WatcherGuru
Crypto Capital Venture
WuBlockchain