Indodax hack — September 2024

Indodax is Indonesia's largest cryptocurrency exchange. On 11 September 2024 attackers drained its hot wallets across several blockchains. The exchange took its web and mobile services offline for what it called comprehensive maintenance after its security team, in its words, discovered potential security indications on the platform. Some analyses date the first outflows to 10 September, and the incident appears to straddle the two dates across time zones.

Published loss figures differ substantially. Cyvers, which raised the first alert, put the total at about $20.5 million, spread across roughly $1.4 million in bitcoin, some $5 million on Tron and Polygon and over $14 million on Optimism and Ethereum. CoinDesk, citing SlowMist and CertiK, reported over $22 million, made up of roughly $14 million in ether, $2.5 million in POL, $2.4 million in TRX and $1.4 million in bitcoin. A later flow-of-funds analysis by Merkle Science reached $25.47 million, most of the difference coming from a higher Ethereum figure of $18.14 million, alongside $2.6 million on Polygon, $2.43 million on Tron, $1.5 million in bitcoin and $870,000 on Optimism. Indodax has never published a number of its own; chief executive Oscar Darmawan said only that the incident caused potential losses of up to several hundred billion rupiah.

The root cause has never been established publicly. Indodax has not disclosed one, and contemporary reporting noted that the exact mechanism of the attack remained undetermined. No cited security firm has published a confirmed entry point.

The exchange stopped withdrawals from the affected wallets, moved remaining funds and later restored services. Darmawan said customer balances in rupiah and crypto were unaffected and disclosed total crypto assets under management of 11.5 trillion rupiah, which he said represented more than 100 percent of the assets held by all users of the system.

On attribution, Darmawan told the Indonesian news agency ANTARA that an analysis by a crypto security agency assisting Indodax indicated the attack was carried out by an actor affiliated to the DPRK. Cyvers' head of AI, Yosi Hammer, said the attack showed characteristics typical of sophisticated groups such as Lazarus, known for rapid asset transfers, access control violations and multiple swaps, while stressing that it was too early to confirm the attackers' identity. No government has formally attributed the theft.