CRAFTY FALCON: India's "Machine Speed" AI Hackers Are Targeting Crypto Exchanges — 5 Checks Before You Leave Coins on an Exchange

India's cybersecurity agency has just put a name to the threat every crypto holder feared after the $6.3 billion Binance hack: CRAFTY FALCON, an AI-assisted campaign that attacks at "machine speed" and has now explicitly named cryptocurrency exchanges among its targets. The warning, updated on November 4, 2026, says wallet keys have already been stolen and funds drained in some incidents. If you still keep long-term holdings sitting on an exchange, the next five checks in this article are the cheapest insurance you will ever buy.

This is not another generic "use a strong password" post. It explains exactly how the campaign works — the tiny test transfer, the abused payment API, the weekend timing — why exchanges are in the crosshairs right now, what the warning does not prove, and the concrete steps that separate traders who survive an exchange compromise from holders who wake up to an empty balance.

What CERT-In Actually Said on November 4

India's Computer Emergency Response Team, CERT-In, updated an October warning on Wednesday, November 4, 2026, designating the threat actor "CRAFTY FALCON" and expanding the target list to explicitly include cryptocurrency exchanges. Until now, the campaign had been described mainly in terms of banks, non-bank financial companies (NBFCs), fintech firms, payment aggregators and payment service providers. The November update is the first to put crypto exchanges on that list in plain terms, according to Cointelegraph's report on the advisory.

The language CERT-In used is unusually blunt for a government advisory. The agency said the threat is "active and ongoing" and that its financial-sector incident response team, CSIRT-Fin, "continues to receive reports of successful attacks, including from NBFCs and fintech entities that had already received the earlier restricted advisories and had undertaken remediation." In other words, some victims had already been warned, had already tried to fix the problem — and were still hit. That single sentence is the most important detail in the whole warning, because it tells you this is not a theoretical vulnerability. It is a campaign that is already getting through defences.

CERT-In also reported that stolen cryptocurrency wallet keys and funds drained from wallets were involved in some incidents. It did not name any specific crypto exchange, and it did not publish a loss total for this campaign. Both gaps matter, and we will come back to them in the myth-busting section below, because they are exactly where rumours start. What is confirmed is the pattern, the tools and the timing — and all three are specific enough to act on today.

The advisory, referenced as CIAD-2026-0046 and CIAD-2026-0049 in Indian press coverage, urges at-risk organisations to treat the campaign as "active and escalating," to heighten monitoring around the clock, and to increase staffing and lower alert thresholds during weekends and holidays, when coverage is thinnest. Deccan Chronicle's coverage notes the advisory is an update to an October 9 warning, which means this campaign has been running for at least a month before it got a public name.

How a "Machine Speed" Attack Actually Works

Forget the Hollywood image of a hooded hacker typing furiously. CERT-In describes CRAFTY FALCON as an actor that "surveys its targets with machine intelligence, operates at machine speed and strikes by invoking the victim's own payment and disbursement APIs." Every clause in that sentence describes a different stage of the attack, and each one defeats a different kind of defence.

First, machine-assisted reconnaissance. The attackers use AI tools to scan a target's systems, generate attack scripts and refine them rapidly, and even reverse-engineer application code to craft exploits tailored to a specific victim. Indian press coverage names several publicly available AI-powered offensive security tools reportedly used in the campaign, including ARTEX, PentAGI, Cairn and CyberStrikeAI. These tools were originally built for legitimate security testing — which is precisely what makes them dangerous in the wrong hands. They can execute complete attack chains autonomously, generate large numbers of tailored scripts in rapid succession, and adapt their payloads based on how the target responds.

Second, the test transaction. Reporting on the campaign describes a chillingly small first step: a Re 1 test transfer — roughly one Indian rupee — to see whether a weak payment API lets money slip through. If the test succeeds, the real movement begins. This is why security teams are told to treat tiny unexplained debits as alarms, not glitches. A one-rupee movement that you did not make is not a rounding error. In this campaign, it may be the attacker checking whether the door is open.

Third, the strike through the victim's own systems. Rather than simply stealing data and leaving, the attackers invoke the victim's own payment and disbursement APIs to move funds. That matters because it can look, to automated monitoring, like legitimate internal traffic. The money is then routed through mule accounts — accounts controlled by intermediaries — via systems such as IMPS and NEFT, before records are deleted to cover the tracks.

Fourth, the timing. CERT-In explicitly warns that attacks are scheduled for weekends and holidays, when operational coverage is lower and detection is slower. That is not a coincidence. It is a deliberate exploitation of the human side of security: fewer eyes on dashboards, slower escalation, and a longer window before anyone freezes anything. If you only check your exchange account on weekdays, this campaign is designed to use the gap.

Put together, the sequence is: AI finds the weak API, a tiny test proves it, the victim's own disbursement system moves the money, mule accounts launder it, and the whole thing happens while the security team is thinnest. No single step requires breaking military-grade encryption. It requires finding one misconfigured system and moving faster than the humans watching it.

Why Crypto Exchanges Are in the Crosshairs Right Now

The CERT-In warning did not arrive in a vacuum. It landed one week after the largest exchange hack in crypto history, and in the worst year on record for crypto theft. Context turns a regional advisory into a global warning for every exchange user.

On October 29, 2026, Binance reported a security incident with an estimated impact of about $6.3 billion. The exchange says around $3 billion has already been frozen, deposits are working normally, and it has pledged to cover affected users. Our own coverage of that event examined the Binance AI-tool hack and the five checks it raised, and the aftermath is still unfolding — including the race to freeze funds as hackers moved back onto THORChain within hours of its reopening, as covered in our THORChain report.

Separately, TRM Labs data cited in industry analysis puts total crypto stolen in 2026 at $8.7 billion as of October 30 — already a record year, before the November CERT-In warning. And between October 30 and November 2, an exploit in unpatched versions of BTCPay Server resulted in the theft of approximately $1.63 million in Bitcoin and Litecoin. None of those figures should be attributed to CRAFTY FALCON specifically — CERT-In has not quantified this campaign's losses — but together they describe an ecosystem under sustained, professional attack. Attackers do not need to invent new techniques when the old ones keep paying.

The regulatory backdrop adds urgency rather than comfort. France has just voted 150–44 to force declarations of self-custody holdings above €100,000, as covered in our France self-custody report, and South Korea now requires exchanges to keep 99% of assets in cold wallets, as explained in our South Korea cold-wallet analysis. Governments are simultaneously pushing holders toward self-custody reporting and pushing exchanges toward colder storage. The direction of travel is clear: the era of leaving everything on an exchange and assuming the platform absorbs the risk is ending.

What Most People Get Wrong About This Warning

Three misunderstandings are already spreading, and each one could cost you money if you act on it.

Myth 1: "A named exchange has been hacked." Wrong. CERT-In did not name any affected crypto exchange. Cointelegraph contacted CERT-In, CoinDCX, CoinSwitch, WazirX, ZebPay and Mudrex for comment, but the advisory itself names no victims. Do not move funds based on a social-media post claiming a specific exchange is compromised unless that exchange or a regulator confirms it. Panic withdrawals into the wrong wallet, or into a phishing site, are exactly how secondary losses happen.

Myth 2: "AI did the whole hack by itself." Overstated. The tools are AI-assisted, not fully autonomous in every case. Human attackers choose targets, adapt payloads and run the laundering. The AI accelerates script generation and reconnaissance. That distinction matters because it means human defences still work: a verified address, a hardware confirmation, a withdrawal whitelist — all of these stop an automated chain cold, because they require a human action the machine cannot fake.

Myth 3: "Self-custody is automatically safe." False, and dangerous. Self-custody removes exchange counterparty risk but concentrates all responsibility on you. A seed phrase photographed, stored in a cloud note, or typed into a fake "validation" site is gone just as surely as an exchange balance drained through an API. The wallet-security guide updated after the Binance hack makes the same point: the most common losses are still seed-phrase phishing and fake support scams, not exotic cryptography breaks. The goal is not to pick a side in the custody debate. It is to stop being the easiest target in either model.

Exchange Custody vs Self-Custody After CRAFTY FALCON

Risk	Exchange custody	Self-custody
Who holds the keys	The exchange	You, on your device
Machine-speed API attack	Direct exposure — the campaign targets this layer	Not directly exposed, unless your hot wallet is connected
Single point of failure	One platform, thousands of users	One person, one seed phrase
Recovery if you lose access	Support can usually restore the account	No support desk — lose the seed, lose the coins
Best use	Trading balances you actively use	Long-term holdings you do not plan to sell soon

The table points to the same conclusion reached by every serious post-Binance analysis, including the reflections on who to trust with crypto assets after the Binance heist: split the job. Exchanges are for trading. Wallets you control are for holding. The worst position is all of your crypto in one place, in one model, with one password standing between it and an automated attack.

The 5-Check CRAFTY FALCON Checklist

Do these five things today, in this order. Each one closes a specific door this campaign uses.

Check 1: Move long-term holdings off exchanges. Keep on an exchange only what you actively trade. Move anything you plan to hold for months or years to a hardware wallet bought directly from the manufacturer — never second-hand, never with a pre-set PIN or pre-printed seed words. Test recovery before you fund it: wipe the device or use a second one, restore from your backup, and confirm the same first receive address appears. Only then deposit. For a full comparison of options, see our best crypto wallets in 2026 comparison and our hardware vs software wallet guide.

Check 2: Lock the exchange account itself. Switch from SMS codes to an authenticator app or a passkey, because text-message codes can be stolen through SIM swaps. Turn on withdrawal address whitelisting and a withdrawal delay if your exchange offers them. A whitelist means that even if an attacker gets in, they cannot send funds to a new address without waiting out the delay — and that delay is exactly what a machine-speed attack cannot afford.

Check 3: Guard the seed phrase offline, forever. Write your 12 or 24 words on paper or stamp them on a metal plate, and store copies in two separate places. Never photograph the phrase, save it in notes, email it, store it in the cloud, or paste it into a chat. No real support team, exchange or wallet company will ever ask for it. Any request for your seed phrase is an attack, full stop. If you have ever typed it anywhere except restoring your own wallet on your own device, assume it is compromised and move the funds to a fresh wallet.

Check 4: Treat tiny unexplained movements as alarms. Turn on transaction alerts for every account, exchange and bank. If you see a tiny test debit or transfer you did not make — even a single rupee, dollar or cent — do not wait to see whether more follow. Freeze the account, change credentials from a clean device, and report the unauthorised movement immediately. In India, CERT-In reporting and the 1930 cybercrime helpline are the routes cited in local coverage; elsewhere, your bank's fraud line and your exchange's support come first. Speed is the defence: this campaign wins when detection is slow.

Check 5: Verify before you click, every time. Verify every withdrawal address on your hardware wallet's own screen, not on your computer or phone display, which malware can fake. Never follow a link from an email, message or social post to "verify" a wallet or "claim" a refund after a hack — post-hack phishing is a second harvest. And before you trust any exchange's safety claims, run the same verification steps in our proof-of-reserves verification guide and our safe-buying guide: proof of reserves is a snapshot, not a guarantee, and the 5% it does not cover is where risk hides.

Timeline: How the Warning Escalated

October 9, 2026: CERT-In issues its first warning about the AI-assisted financial campaign, in restricted advisories to financial firms. October 29, 2026: Binance reports its $6.3 billion incident, resetting every holder's sense of exchange risk. October 30 to November 2, 2026: the BTCPay Server exploit takes approximately $1.63 million, a reminder that smaller infrastructure is targeted too. November 4, 2026: CERT-In updates the advisory, names CRAFTY FALCON, explicitly adds crypto exchanges, and urges round-the-clock monitoring through weekends and holidays. November 5, 2026: the warning reaches global crypto press, and the question for holders stops being whether AI-assisted attacks are real and becomes what you changed before the next weekend.

What to Do in the Next 24 Hours

If you hold crypto on an exchange, tonight is the time to act, not next week. Start with the highest-value account. Enable whitelisting and an authenticator app. Move long-term holdings to a hardware wallet you already own, or order one from the manufacturer today and move funds the moment it arrives and passes a recovery test. Turn on alerts everywhere. Then, and only then, check whether your exchange has published any statement about the CERT-In advisory — and treat silence as a reason to hold less there, not more.

If you run a business that touches crypto payments, the advisory is addressed to you directly: separate test environments from live systems, set daily transfer limits, verify beneficiaries, flag unusually fast transactions, and staff monitoring through weekends and holidays.

Finally, keep perspective. This warning does not mean every exchange is about to fall, and it does not mean Bitcoin itself is broken. Blockchains do what they have always done: record transfers exactly as signed. The vulnerability is in the systems around the chain — the APIs, the accounts, the humans — and those are fixable, one check at a time. The holders who lose money in machine-speed campaigns are rarely the ones who lacked information. They are the ones who left it until Monday.

Frequently Asked Questions

What is CRAFTY FALCON?

CRAFTY FALCON is the name CERT-In, India's national cybersecurity agency, gave on November 4, 2026, to an ongoing AI-assisted campaign targeting banks, NBFCs, fintech firms, payment providers and, in the latest update, cryptocurrency exchanges. It uses AI tools to survey targets, generate attack scripts and exploit payment and disbursement APIs at machine speed.

Has a specific crypto exchange been named as a victim?

No. CERT-In has not named any specific exchange or quantified losses for this campaign. Reports that a particular exchange has been hacked by CRAFTY FALCON should be treated as unverified unless the exchange or a regulator confirms them.

How do I know if I have been targeted?

Watch for tiny unexplained test transfers, unexpected withdrawal or login alerts, and any transaction you did not authorise. Treat a small unexplained debit as a warning sign, freeze the account, and report it immediately rather than waiting for a larger movement.

Is self-custody safer than keeping crypto on an exchange?

For long-term holdings, yes — provided you protect the seed phrase offline and test recovery before funding the wallet. Self-custody removes exchange API risk but makes you solely responsible for backups. For active trading balances, a locked-down exchange account with whitelisting and authenticator-based two-factor authentication remains practical.

Do I need to move my crypto today?

You do not need to panic-sell anything. You should, however, move long-term holdings you do not plan to trade off exchanges as soon as you can do so safely — ideally to a hardware wallet you have already tested. Moving in a rush to an untested wallet, or through a link from an unsolicited message, creates new risk.

What should businesses do differently after this advisory?

Separate test from live systems, enforce daily transfer limits and beneficiary verification, flag unusually fast transactions, lower alert thresholds, and maintain heightened monitoring during weekends and holidays — the windows this campaign deliberately exploits.

Conclusion

CRAFTY FALCON is not a reason to leave crypto. It is a reason to stop treating exchange accounts as vaults. India's warning gives holders something rare in security news: a specific attacker name, a specific technique, and a specific timing pattern — and therefore a specific defence. Move what you hold long-term to a wallet you control, lock the exchange accounts you still use, guard your seed phrase offline, treat tiny unexplained movements as alarms, and verify every address on a device screen. Do those five things before the next weekend, and a machine-speed campaign will have to find an easier target than you.