Crypto exchanges across Asia are hardening defenses against a surge in AI-assisted cyberattacks. India's national cybersecurity agency, the Indian Computer Emergency Response Team (CERT-In), issued a warning Wednesday about a threat actor designated "CRAFTY FALCON" that has successfully stolen wallet keys and siphoned funds from cryptocurrency exchanges, non-banking financial companies, and fintech entities. CERT-In noted the threat remains active, with reports of successful attacks continuing.
The advisory points to AI tools weaponized against financial infrastructure. In October, cybersecurity firm CrowdStrike documented an unidentified attacker deploying ARTEX, an AI penetration-testing tool, alongside Claude Code and other AI models to breach South Korean financial firms and steal data. ARTEX is referenced in CERT-In's advisory.
South Korea's Financial Services Commission (FSC) convened an emergency meeting with domestic regulators, cybersecurity agencies, and crypto service providers to review security measures—IT access controls, wallet withdrawal approval procedures, and administrator privileges. The FSC has urged exchanges to increase cold storage holdings. South Korean law already mandates exchanges hold at least 80 percent of user assets in cold wallets. Current compliance: Upbit holds 99.17 percent, Bithumb maintains 94.76 percent, and Coinone secures 85 percent.
The FSC's push follows the $6.3 billion Binance hack. The Bank of Korea is now surveying 31 financial institutions to assess systemic exposure to major crypto market disruptions, including scenarios of a major hack forcing temporary suspension of South Korea's largest exchange by market share, steep cryptocurrency price declines followed by sustained trading slumps, and fallout from another institution suffering heavy losses from crypto-related incidents.
North Korea has denied involvement in the Binance breach despite documented evidence linking Pyongyang to billions in crypto exchange thefts over several years. Kim Yo Jong, a prominent North Korean official, called the FBI's efforts to designate the Democratic People's Republic of Korea as a "cyber criminal state" absurd rhetoric and suggested Americans were responsible for the incident.
Separately, South Korea is planning to delay crypto tax implementation again, targeting 2029 for the next deferral.
