India’s cyber agency did not bury the lead. On 4 November 2026 the Indian Computer Emergency Response Team (CERT-In) issued Critical advisory CIAD-2026-0058, an update to its 9 October warning on payment-API theft, and named the actor CRAFTY FALCON. The advisory’s own text puts cryptocurrency exchanges and virtual digital asset service providers on the target list: wallet keys stolen, funds siphoned. That is the India-first fact most global wire copy softens.
What CERT-In actually said
CSIRT-Fin, the finance response team under CERT-In, describes CRAFTY FALCON as an AI-assisted financial threat actor that surveys targets with machine intelligence, runs at machine speed, and strikes by calling the victim’s own payment and disbursement APIs. The campaign remains active. Entities that already remodeled after the October notes have been deliberately re-targeted, including after incomplete fixes. Attacks are timed for holidays, weekends and other low-monitoring windows.
Named tools include ARTEX, PentAGI, Cairn, and CyberStrikeAI, which generate tailored scripts at machine speed. See The Indian Express and the CIAD-2026-0058 mirror at Complied AI. CERT-In named no exchange and published no rupee loss figure.
The attack pattern in plain steps
| Stage | What the advisory describes | Why it matters in India |
|---|---|---|
| Entry | Exposed UAT/staging, shared credentials into production, cloud management abuse | Festive staffing gaps stretch detection time |
| Bypass | Altered client apps calling APIs; traffic from whitelisted fetcher IPs | IP allow-lists alone are not enough |
| Probe | Micro-value tests such as ₹1 to new beneficiaries | Clearest retail-facing signal in the text |
| Cash-out | Merchant settlement APIs; stolen exchange wallet keys | Hot-wallet concentration risk for VDA platforms |
| Speed | AI-generated script variants refined in rapid succession | Human SOC playbooks lag machine-speed loops |
What it means for Indian investors
Retail holders do not patch AWS roles; they choose where coins sit overnight. CERT-In tells exchanges to keep wallet keys in HSMs or cold custody, require multi-sig withdrawals, monitor patterns, and rotate keys on suspected compromise—a useful custody filter for FIU-IND-registered platforms.
Practical checks:
- Prefer platforms on the FIU-IND registered exchange checker over unmarked apps.
- Turn on withdrawal allow-lists, delays and multi-factor authentication; treat any unexpected ₹1 credit or debit as a red flag.
- Keep only what you need to trade on an exchange; move long-term holdings offline.
- If funds are already gone, call 1930 and follow our note on seed-phrase and fake-support fraud. Exchange-side key theft differs from phishing, but the reporting door is the same.
- Compare fee and custody trade-offs with the crypto exchange fee calculator before parking a large balance for convenience.
BtcMedia verdict
CRAFTY FALCON is a Critical state advisory that exchanges’ APIs and hot wallets are under AI-speed pressure, with ₹1 probes as the rehearsal and festive weekends in the threat model. Until losses are named, treat any venue that cannot describe cold custody and multi-sig withdrawals as optional risk.
How we calculated this: facts are taken from CERT-In advisory CIAD-2026-0058 (4 Nov 2026) as mirrored in the Complied AI document text and corroborated by The Indian Express (updated 5 Nov 2026, 12:25 PM IST). No loss totals were invented; the agency published none.
FAQ
Did CERT-In say which Indian crypto exchange was hit?
No. CIAD-2026-0058 lists cryptocurrency exchanges among affected entity types and describes stolen wallet keys, but it does not name firms or rupee amounts.
What is the ₹1 test CERT-In mentioned?
Attackers run micro-value transfers (the advisory cites examples such as ₹1) to confirm an unauthorized path works, then push large-value transfers. Platforms are told to flag that pattern.
Should Indian investors leave crypto on exchanges right now?
CERT-In does not order retail withdrawals. Its custody guidance to platforms—HSM or cold custody, multi-sig withdrawals, anomaly monitoring—is a useful yardstick for how much overnight risk you leave on any single venue.
Not financial advice. This article summarises a public cybersecurity advisory and does not recommend buying, selling or holding any asset.