Indonesian Crypto Exchange Indodax Suffers $22M Hack, System Goes Offline

Indonesian centralized crypto exchange Indodax recently became the latest victim of security exploits, losing approximately $22 million to attacker(s) at press time.

Blockchain security platform Cyvers Alerts was the first to detect the exploit and alerted the crypto exchange to address the issue. About three hours later, Indodax halted operations and commenced “complete maintenance to ensure the entire system is operating properly.”

Indodax Hacked for $22M

On-chain data shows that the hacker initially stole $14.4 million from the exchange via blockchain networks like Ethereum, Polygon, Tron, and Optimism. Over a few hours, the losses increased to approximately $22 million. The stolen assets included 5,204.3 ETH ($12.37 million), 6.8 million POL ($2.64 million), and 16.7 million TRX ($2.55 million).

The theft also swept 25.01 BTC ($1.44 million), 380 ETH ($900,000) via the Optimism network, and $1.2 million worth of ERC-20 tokens.

An investigation of the blockchain security protocol SlowMist found that a withdrawal system security breach likely triggered the attack. The hacker possibly compromised the exchange’s hot wallet private key to access the funds.

Indodax Still Holds Over $367M

Despite how Indodax parted ways with $22 million worth of crypto assets, public data from CoinMarketCap shows that the firm retains over $367 million worth of users’ funds in its care. This sizeable portfolio calms investors that a significant portion of their funds are not lost.

Highlighting that investors’ assets are safe, Indodax wrote in its announcement:

“Currently, we are conducting a complete maintenance to ensure the entire system is operating properly. During this maintenance process, the INDODAX web platform and application are temporarily inaccessible. But don’t worry, we can assure you that your balance remains 100% safe both in crypto and rupiah [the country’s sovereign currency].”

Although shocking, Indodax’s latest exploit is significantly lower than its India-based rival firm, WazirX, which suffered a $230 million attack in July. As of this writing, WazirX has yet to recover the stolen assets.