Asia Strengthens Cryptocurrency Exchange Protection Amid AI Attacks

Regulators in India and South Korea have warned cryptocurrency platforms about new risks of cyberattacks and the need to strengthen the protection of client assets. The Indian CERT-In reported on the use of artificial intelligence tools by attackers, while South Korean authorities recommended exchanges increase the share of cryptocurrencies stored in offline wallets.

On November 4, the Indian Computer Emergency Response Team (CERT-In) issued a warning about an active campaign called CRAFTY FALCON targeting financial organizations. Potential targets include cryptocurrency exchanges, fintech companies, payment services, and non-bank financial institutions.

According to the regulator, attackers use tools like ARTEX, PentAGI, Cairn, and CyberStrikeAI to automate vulnerability searches, create malicious scenarios, and conduct attacks.

These systems allow for quick analysis of company infrastructure, finding ways to bypass protection, and altering actions based on the response of the targeted services.

CERT-In has recorded cases of unauthorized use of payment APIs, theft of account credentials, and secret keys of crypto wallets. Some organizations faced repeated attacks even after taking initial protective measures.

“The threat remains active and ongoing,” the agency's warning states.

Experts also note that attackers choose holidays and weekends when monitoring capabilities may be limited.

CERT-In recommended financial organizations ensure round-the-clock monitoring of infrastructure, isolate test environments from production systems, verify payment transactions, and use hardware protection for cryptographic keys.

South Korea Revises Crypto Exchange Protection

Amid the large-scale hack of Binance, South Korea's Financial Services Commission (FSC) held an emergency meeting on November 2 with representatives of crypto exchanges and agencies responsible for information security.

According to the regulator's assessment, approximately $6.3 billion in digital assets were unauthorizedly withdrawn during the attack on Binance at the end of October.

During the inspection, the FSC examined employee access to information systems, procedures for confirming fund withdrawals, key storage, and management of administrative privileges.

The regulator recommended companies increase the share of assets in cold wallets, enhance monitoring of deposits and withdrawals, ensure additional staff for incident response, and increase financial reserves.

South Korean legislation already requires crypto exchanges to keep at least 80% of client assets in cold wallets not permanently connected to the internet.

As of the end of September 2026, Upbit's share of such storage was 99.17%, Bithumb's was 94.76%, and Coinone's was 85%. These figures reflect previously existing security measures, not the results of November's recommendations.

Separately, the Bank of Korea requested information from 31 financial organizations about the potential consequences of major incidents in the crypto market. The study involves 18 banks and 13 brokerage firms.

Scenarios being considered include the temporary shutdown of the largest crypto exchange after a hack, prolonged declines in digital asset prices, and significant losses for financial organizations.

The Indian warning and South Korea's measures reflect two directions in protecting cryptocurrency infrastructure: countering automated attacks and reducing the risk of fund loss when internet-connected systems are compromised. However, no connection has been established between the CRAFTY FALCON group and the Binance incident.