India Warns Hackers Are Using AI to Breach Crypto Exchanges and Steal Funds, Flags Weekend-Holiday Attacks
Summary
- CERT-In, India's Computer Emergency Response Team, said hackers are using AI to exploit security vulnerabilities at cryptocurrency exchanges and steal funds.
- It said the hacking group Crafty Falcon was found to be directly calling payment and payout APIs to manipulate fund transfers.
- CERT-In said it had advised exchanges and financial firms to bolster security staffing on weekends and public holidays and strengthen alerts for suspicious activity.
Hackers are using artificial intelligence to find security vulnerabilities at cryptocurrency exchanges, breach their systems and manipulate internal payment infrastructure to steal funds, Indian authorities warned. Officials also identified attacks timed for weekends and public holidays, when security staffing is thinner.
Cointelegraph reported on November 5 that CERT-In, India's Computer Emergency Response Team, disclosed the tactics used by a hacking group known as Crafty Falcon and urged exchanges and financial firms to stay on alert. After issuing an initial warning in October, the agency this time explicitly named cryptocurrency exchanges as targets.
The attacks began through poorly secured apps or development and testing systems. The hackers then expanded their access into live production systems and directly called payment and payout APIs that handle fund transfers to siphon off money. APIs are channels through which systems exchange functions and data, meaning the attackers abused legitimate payout functions.
AI was used to speed up both the preparation and execution of the attacks. The hackers analyzed the target company's program code and rapidly created or modified the malicious code needed for the breach. Authorities described the pace of the attacks as moving at "machine speed."
Damage is continuing even at companies that had already taken security measures. CERT-In said it was still receiving reports from non-bank financial companies and fintech firms that had previously received a limited alert and implemented security steps.
The authorities recommended increasing monitoring staff on weekends and public holidays and configuring alerts to go off even over smaller-than-usual signs of abnormal activity. They did not disclose the names of the affected exchanges or the amount of the losses.
