India CERT-In Issues Industry-Wide Alert: AI-Powered Hackers Target Crypto Exchanges at Machine Speed

⚡️ Machine-Speed Attacks: A New Security Challenge for the Crypto Industry

India’s Computer Emergency Response Team (CERT-In) recently released an industry-wide security alert, explicitly noting that cyberattacks targeting global crypto exchanges have entered an AI-driven "machine speed" phase. Adversaries leverage large language models (LLMs) to automate phishing copy generation, key brute-force attempts, and system vulnerability scans, with a single attack device completing over 1,000 attempts per second—over 300 times the efficiency of manual penetration testing. These attacks can often complete the full exploit chain before security teams can even respond. Contrary to the common assumption that most exchange asset thefts stem from insider misconduct or poor user security awareness, 37% of global exchange security incidents in the past six months involved AI attack tools; attackers no longer need advanced programming skills, and can launch large-scale penetration campaigns via low-cost, subscription-based AI attack services.

? Attack Logic: Why Crypto Exchanges Are AI Hackers’ Top Priority Target

From a target-selection perspective, crypto exchanges have long been the preferred hunting ground for AI-powered threat actors. On-chain assets are irreversible, with no centralized channel to freeze stolen funds, making recovery nearly impossible once assets are transferred. Meanwhile, over 62% of small and mid-sized crypto exchanges globally still operate with security investment levels on par with those from five years ago, with many lacking even basic real-time abnormal transaction detection mechanisms. Contrary to the myth that AI hackers would first target high-value traditional assets like banks or government systems, crypto exchanges deliver 12x the attack return on investment (ROI) of traditional financial institutions; most exchange hot wallets are protected only by single password verification, creating an extremely low barrier to compromise.

? Real-World Case: The Destructive Scale of Machine-Speed Attacks

An AI attack on a mid-sized Southeast Asian crypto exchange earlier this year perfectly illustrates the terrifying destructive power of machine-speed exploits. Attackers used LLMs to automatically generate phishing websites with domain names differing from the official site by just one character, while mimicking official customer service tone to send mass private messages to active users. Over three days, attackers transferred $12 million in assets, with no manual intervention across the full attack chain. Contrary to the assumption that phishing requires manual outreach and tailored script adjustments for different user groups, AI can generate over 1,000 versions of phishing links and conversation scripts in 10 minutes, and use publicly available on-chain transaction data to customize scam pitches for users across different asset tiers.

⚙️ High-Risk Zone: The Obvious Protection Gaps at Small and Mid-Sized Exchanges

When looking at the distribution of attack targets, small and mid-sized crypto exchanges with under $100 million in assets have become the primary focus of AI hackers. To cut operational costs, these platforms often lack dedicated in-house security teams, relying solely on third-party vendors for basic protection. Many even store hot wallet private keys directly on public cloud servers, failing to implement even the most basic controls like physical isolation, multi-signature verification, or real-time abnormal transaction alerts. Contrary to the myth that hackers only target top-tier exchanges and ignore small platforms due to their smaller asset base, 80% of crypto exchanges successfully compromised by AI attacks in the past year were small or mid-sized, as their abundant vulnerabilities can be identified in a single AI scan, driving attack costs to near-negligible levels.

?️ Response Misconceptions: Why Traditional Security Solutions Cannot Block AI Hackers

Facing the rising tide of AI-driven attacks, many exchange security teams remain trapped in legacy protection path dependence, treating firewall deployment and increased password complexity as core response measures. These solutions are effective against low-frequency, manually launched traditional attacks, but their protection efficacy drops by half when facing AI tools that scan thousands of port vulnerabilities per second. Contrary to the assumption that adding more firewall layers or multi-factor authentication checks can stop AI hackers, AI tools scan vulnerabilities 100 times faster than traditional firewalls can iterate rule sets; by the time security teams identify a vulnerability and deploy a patch, AI actors have already exploited the unpatched gap to move hot wallet assets to crypto mixing services.

? User Perspective: AI Phishing Detection Difficulty Is Rising Exponentially

Amid the wave of AI-driven attacks, risk has long spilled over from exchange platforms to everyday end users. AI-generated fake customer service accounts and phishing websites are now nearly indistinguishable from official channels: profile avatars, post histories are all batch-generated by AI, and page interaction logic, load speeds are identical to official platforms, making it impossible for average users to tell real from fake with the naked eye. Contrary to the assumption that users can avoid AI phishing by memorizing official domains and avoiding unknown links, AI can now generate fake sites with domain names differing from official ones by a single letter, even pushing targeted content based on user search habits; even veteran security engineers often need to verify domain certificates to spot fakes.

? Future Trend: The AI Offense-Defense Game Is Only Just Beginning

From a long-term industry perspective, AI-driven cyber offense and defense is fundamentally a game of "using AI to fight AI". Many top-tier crypto exchanges have already begun developing dedicated security LLMs to monitor abnormal logins and transactions across their platforms in real time, cutting security response latency from hours to milliseconds. Contrary to the assumption that AI hackers are unbeatable and targeted platforms are guaranteed to suffer losses, applying AI tools to defense can raise attacker costs by dozens of times; AI defense systems can identify mass brute-force and abnormal access attack signatures in 0.1 seconds, blocking attack chains before hackers can gain a foothold.

This official security alert from Indian authorities serves as a critical wake-up call for the entire crypto industry: as AI technology rapidly becomes ubiquitous, legacy security frameworks can no longer keep pace with "machine-speed" attack rhythms. Neither platform operators nor everyday users can afford to take security for granted. After all, there is no "undo" option for on-chain asset losses; once funds are stolen in an attack, recovery is nearly impossible. While many assume crypto security risks will naturally resolve as technology matures, the reality is that as barriers to accessing AI attack tools continue to fall, security incidents targeting the crypto sector will keep rising over the next 2-3 years. Only by building AI defense capabilities on par with offensive tools can platforms truly safeguard users’ on-chain asset security.