Indonesia’s largest crypto exchange halts over third security scare in two years

Indodax has paused processing customer deposits and withdrawals, according to CEO William Sutanto, as of this morning.

The service halt was initiated as a precaution after Indonesia’s largest crypto exchange noticed a spike in cyberattack attempts. The CEO quickly moved to calm the pressure, stressing that customer funds are safe.

What Indodax’s CEO told users

CEO Sutanto wrote on X in a post that translates as “Indodax is temporarily suspending deposits and withdrawals as a security measure because we have detected an increase in cyber attack attempts.” The CEO apologized for the inconvenience and promised that “Deposits and withdrawals will be reopened once safety is confirmed.”

According to reports, both rupiah and crypto transfers stopped being processed on Indodax around 05:24 UTC, which is 12:24 local time in Indonesia. However, traders still reported limited access to spot markets. Some also said they could still check their balances during the freeze.

In a follow-up post, Sutanto said Indodax was rechecking its systems as a preventive measure, to confirm its detection tools met strict security standards.

As of this report, Indodax has not committed to a date or time for when deposits and withdrawals will resume. It directed customers to look out for updates from its official channels.

Indodax suffered a hack in 2024

Indodax lost about $20 million from its hot wallet in September 2024, making this the exchange’s second security incident in two years. A hot wallet is an internet-connected storage that an exchange uses to process everyday withdrawals.

Former CEO Oscar Darmawan confirmed the loss at the time, blaming the breach on a malware-laced file that an IT staffer downloaded for a side gig they took on with their official laptop. Darmawan noted that the freelancing on the side on company device is against policy.

Today’s response mirrors some parts of the exchanges response to the 2024 breach. Then too, Indodax shut down withdrawals after detecting the intrusion around 4 a.m. Next, it completely shut off its system. Full recovery took roughly 80 hours and six cybersecurity firms, including Bappebti, OJK and the national police.

As Cryptopolitan reported at the time, Indodax said it covered the lost reserves in full.

This time around, Indodax has clarified that it paused transfers before any money left the exchange.