{"investigation":{"slug":"indodax","entity_name":"Indodax","trust_score":28,"severity_base":null,"score_modifier":0,"confidence":1,"status":"published","content_type":"investigation","summary":"Indodax (formerly Bitcoin Indonesia) is Indonesia's largest licensed cryptocurrency exchange, founded in 2014 by Oscar Darmawan and William Sutanto and serving over 9.6 million users. In September 2024, the exchange suffered a major security breach attributed to North Korea's Lazarus Group, resulting in approximately $22–25 million in losses across multiple blockchains. The exchange pledged full reimbursement to affected users, resumed operations within roughly 80 hours, and has since undergone a leadership restructuring.","sections":[{"content":"Indodax was co-founded as Bitcoin Indonesia in February 2014 by Oscar Darmawan and William Sutanto and rebranded to Indodax in 2018. Headquartered in Jakarta, Indonesia, it is the country's oldest and largest domestic cryptocurrency exchange, listing over 450 digital assets across more than 490 trading pairs as of early 2026. The platform has reported over 9.6 million registered users. Indodax received formal regulatory approval from Bappebti (Badan Pengawas Perdagangan Berjangka Komoditi) as a licensed Physical Crypto Asset Trader (PFAK). Following a government regulation issued on 31 December 2024 (Government Regulation No. 49 Year 2024), supervisory authority transferred from Bappebti to Indonesia's Financial Services Authority (OJK) effective 10 January 2025. Indodax was among the 29 platforms licensed under the new OJK framework announced in 2025. In May 2025, Oscar Darmawan transitioned from CEO to Chairman, with co-founder William Sutanto, formerly CTO, assuming the CEO role.","heading":"Background","sources":[{"url":"https://coinmarketcap.com/exchanges/indodax/","name":"","type":"other","credibility":3},{"url":"https://www.lexology.com/library/detail.aspx?g=7a498fdd-ad79-4f74-a489-a33f94eac135","name":"","type":"other","credibility":3},{"url":"https://indotech.group/indodax-announces-leadership-restructuring-william-sutanto-appointed-as-new-ceo/","name":"","type":"other","credibility":3}],"severity":"medium"},{"content":"On September 10–11, 2024, blockchain security firms Cyvers and SlowMist detected a series of unauthorized outflows from Indodax's hot wallets across multiple blockchain networks. The exchange suspended all services on September 11, 2024, citing a security incident requiring maintenance. CEO Oscar Darmawan confirmed in a written statement dated September 14, 2024, that 'an analysis conducted by a crypto security agency helping us right now indicated that the attack was perpetrated by an actor affiliated to the DPRK.' Cyvers identified over 150 suspicious transactions and noted that the attack pattern and characteristics bore strong resemblance to prior operations by North Korea's Lazarus Group. SlowMist's MistTrack analysis alleged a shared laundering address linking the Indodax breach to the BingX hack that occurred the same month, further implicating Lazarus Group. Forensic analysis alleged the initial vector was a compromised signature machine — the hardware used to authorize and sign transactions — potentially accessed via an infected engineer's laptop through a social engineering campaign. Indodax cooperated with Indonesia's Bareskrim (Criminal Investigation Agency), Bappebti, OJK, and the National Cyber and Encryption Agency (BSSN) in the subsequent investigation. The exchange restored services approximately 80 hours after the breach, on September 14–17, 2024.","heading":"The Lazarus Hack","sources":[{"url":"https://en.antaranews.com/news/325999/north-korea-affiliated-actor-likely-hacked-crypto-exchange-indodax","name":"","type":"other","credibility":3},{"url":"https://invezz.com/news/2024/09/11/indodax-hacked-for-22-million-lazarus-group-suspected/","name":"","type":"other","credibility":3},{"url":"https://therecord.media/indodax-crypto-exchange-pledges-to-reimburse-after-theft","name":"","type":"other","credibility":3},{"url":"https://www.nknews.org/2024/09/north-korean-cybercriminals-steal-22m-from-indonesian-crypto-exchange/","name":"","type":"other","credibility":3},{"url":"https://coinmarketcap.com/academy/article/indodax-crypto-exchange-suffers-major-hack-over-dollar22-million-in-losses","name":"","type":"other","credibility":3}],"severity":"medium"},{"content":"On-chain analysis by Cyvers, SlowMist/MistTrack, and Merkle Science documented the flow of stolen assets across five blockchain networks. Merkle Science's Hack Track report estimated total losses at approximately $25.47 million when accounting for assets across all chains: roughly $18.14 million in Ethereum-based tokens, $2.6 million on Polygon (including approximately 2.2 million POL tokens and 1.8 million USDT), $2.43 million on Tron (including approximately 2.36 million USDT and 160 billion BTT tokens), $1.5 million in Bitcoin (approximately 26.26 BTC), and $870,000 in ETH on Optimism. Cyvers reported the attacker executed over 150 discrete transactions and rapidly converted stolen ERC-20 tokens into ETH — a tactic used to prevent token-level blacklisting. A portion of the converted ETH, estimated at approximately 5,000 ETH, was subsequently routed through Tornado Cash, the OFAC-sanctioned mixing service, to obscure the trail. MistTrack alleged that a shared address appeared in the laundering chain of both the Indodax and BingX hacks, providing circumstantial on-chain linkage between the two incidents and the Lazarus Group. The synchronized, multi-chain nature of the attack was noted by analysts as consistent with known Lazarus Group operational patterns.","heading":"On-Chain Evidence","sources":[{"url":"https://www.merklescience.com/blog/hack-track-indodax-flow-of-funds-analysis","name":"","type":"other","credibility":3},{"url":"https://www.bitget.com/news/detail/12560604205326","name":"","type":"other","credibility":3},{"url":"https://www.bittime.com/en/blog/hacker-indodax-dan-bingx-diduga-hacker-korea-utara-lazarus-group","name":"","type":"other","credibility":3},{"url":"https://www.thecoinrepublic.com/2024/09/12/is-your-crypto-safe-indonesia-exchange-indodax-hacked-for-22m/","name":"","type":"other","credibility":3}],"severity":"medium"},{"content":"Indodax holds a license as a Physical Crypto Asset Trader (PFAK) under Indonesian law, originally granted by Bappebti and remaining valid under the authority transition to OJK in January 2025. Indodax was named among 29 platforms licensed by OJK under the new crypto asset regulatory regime. The OJK regime expanded its approved crypto asset list to 1,444 tokens in April 2025, up from Bappebti's prior list of 851. Indodax is required to comply with governance, personal data protection, and consumer protection provisions introduced under OJK's framework, with a six-month grace period from January 12, 2025. No formal regulatory sanction or enforcement action by Bappebti or OJK against Indodax has been publicly identified in relation to the September 2024 hack. Indodax cooperated voluntarily with Bareskrim and government agencies during the incident. The exchange provides on-chain Proof of Reserves (PoR) and stated that its total managed crypto assets exceeded 100 percent of all user holdings at the time of the breach.","heading":"Regulatory Status (OJK / Bappebti)","sources":[{"url":"https://www.lexology.com/library/detail.aspx?g=7a498fdd-ad79-4f74-a489-a33f94eac135","name":"","type":"other","credibility":3},{"url":"https://bitcoinethereumnews.com/crypto/indonesias-ojk-licenses-29-crypto-platforms-under-new-regulation/","name":"","type":"other","credibility":3},{"url":"https://ojk.go.id/en/fungsi-utama/itsk/perizinan-itsk-aset-keuangan-digital-aset-kripto/default.aspx","name":"","type":"other","credibility":3}],"severity":"medium"},{"content":"At the time of the breach, Indodax served over six million registered users. The exchange suspended all services on September 11, 2024, leaving users unable to access funds for approximately three to four days. Indodax publicly pledged to compensate any users whose funds were directly affected by the attack. CEO Oscar Darmawan stated that total crypto assets under management stood at approximately Rp 11.5 trillion (roughly $746 million at the time), exceeding 100 percent of user holdings, indicating the exchange held sufficient reserves to cover the loss without a shortfall in user balances. Services were restored between September 14 and 17, 2024. The exchange issued warnings about secondary scams exploiting the situation. Post-recovery trading volume reportedly rebounded to Rp 547 billion, according to Indonesian financial news outlet Infobanknews. No widespread reports of individual users failing to receive reimbursement have been identified in publicly available sources reviewed for this investigation.","heading":"User Impact","sources":[{"url":"https://therecord.media/indodax-crypto-exchange-pledges-to-reimburse-after-theft","name":"","type":"other","credibility":3},{"url":"https://en.antaranews.com/news/325999/north-korea-affiliated-actor-likely-hacked-crypto-exchange-indodax","name":"","type":"other","credibility":3},{"url":"https://www.digivestasi.com/news/detail/aset_kripto/indodax-finished-maintenance-user-funds-ensured-safe-services-return-to-normal?lang=eng","name":"","type":"other","credibility":3}],"severity":"medium"},{"content":"Indodax presents a mixed risk profile. On the positive side, it is a licensed, regulated entity under OJK, Indonesia's apex financial regulator; it has operated continuously since 2014; it holds Proof of Reserves exceeding user liabilities; and it fully absorbed the 2024 hack loss without reported harm to individual user balances. However, the September 2024 breach — attributed with medium-to-high confidence to the Lazarus Group — exposed severe deficiencies in hot wallet security and signature machine controls. The loss figure, estimated between $22 million and $25.47 million depending on the source, represents one of the largest crypto exchange hacks in Southeast Asian history. The alleged initial vector — a compromised engineer's laptop via social engineering — indicates that insider threat and operational security practices require ongoing scrutiny. The use of Tornado Cash for laundering the proceeds means a portion of the stolen funds is likely unrecoverable. A leadership transition in May 2025 (new CEO William Sutanto, previously CTO) may signal a renewed focus on technology and security, but the depth of post-hack remediation has not been independently verified in publicly available sources. Users should be aware that centralized exchanges with large hot wallet holdings remain attractive targets for state-sponsored threat actors, and should evaluate Indodax's security posture improvements before depositing significant funds.","heading":"Risk Assessment","sources":[{"url":"https://hacken.io/discover/lazarus-group/","name":"","type":"other","credibility":3},{"url":"https://www.halborn.com/blog/post/month-in-review-top-defi-hacks-of-september-2024","name":"","type":"other","credibility":3},{"url":"https://blockchaingroup.io/compliance-and-regulation/top-10-crypto-losses-of-2024-hacks-frauds-and-exploits/","name":"","type":"other","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2014-02","event":"Bitcoin Indonesia (later Indodax) founded by Oscar Darmawan and William Sutanto in Jakarta","source":"","date_original":"2014-02-01"},{"date":"2018","event":"Platform rebrands from Bitcoin Indonesia to Indodax","source":"","date_original":"2018-01-01"},{"date":"2020","event":"Indodax receives Bappebti PFAK license as Indonesia's first licensed crypto exchange","source":"","date_original":"2020-01-01"},{"date":"2024-09-10","event":"Blockchain security firm Cyvers detects first suspicious outflows from Indodax hot wallets","source":""},{"date":"2024-09-11","event":"Indodax suspends all platform services; breach confirmed; Lazarus Group suspected by Cyvers and SlowMist","source":""},{"date":"2024-09-13","event":"Indodax publicly discloses breach and pledges full user reimbursement","source":""},{"date":"2024-09-14","event":"CEO Oscar Darmawan issues written statement attributing attack to DPRK-affiliated actor; cooperation with Bareskrim and BSSN confirmed","source":""},{"date":"2024-09-14","event":"Indodax begins restoring services; recovery completed over approximately 80 hours","source":""},{"date":"2024-12-31","event":"Indonesia issues Government Regulation No. 49/2024 transferring crypto supervision from Bappebti to OJK, effective 10 January 2025","source":""},{"date":"2025-01-10","event":"OJK assumes regulatory oversight of Indonesian crypto exchanges including Indodax","source":""},{"date":"2025-04","event":"OJK publishes expanded crypto asset approved list (1,444 tokens); Indodax included among 29 licensed platforms","source":"","date_original":"2025-04-01"},{"date":"2025-05-19","event":"William Sutanto (former CTO) appointed CEO; Oscar Darmawan becomes Chairman","source":""}],"sources_used":[{"url":"https://coinmarketcap.com/exchanges/indodax/","name":"","type":"other","archive_url":"http://web.archive.org/web/20260812100407/https://coinmarketcap.com/exchanges/indodax/","credibility":3,"archive_timestamp":"2026-08-12T10:04:07+00:00"},{"url":"https://www.lexology.com/library/detail.aspx?g=7a498fdd-ad79-4f74-a489-a33f94eac135","name":"","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://indotech.group/indodax-announces-leadership-restructuring-william-sutanto-appointed-as-new-ceo/","name":"","type":"other","archive_url":"https://web.archive.org/web/20260829134457/https://indotech.group/indodax-announces-leadership-restructuring-william-sutanto-appointed-as-new-ceo/","credibility":3,"archive_timestamp":"2026-08-29T13:44:57+00:00"},{"url":"https://en.antaranews.com/news/325999/north-korea-affiliated-actor-likely-hacked-crypto-exchange-indodax","name":"","type":"other","archive_url":"http://web.archive.org/web/20251013020815/https://en.antaranews.com/news/325999/north-korea-affiliated-actor-likely-hacked-crypto-exchange-indodax","credibility":3,"archive_timestamp":"2025-10-13T02:08:15+00:00"},{"url":"https://invezz.com/news/2024/09/11/indodax-hacked-for-22-million-lazarus-group-suspected/","name":"","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://therecord.media/indodax-crypto-exchange-pledges-to-reimburse-after-theft","name":"","type":"other","archive_url":"http://web.archive.org/web/20260310145118/https://therecord.media/indodax-crypto-exchange-pledges-to-reimburse-after-theft","credibility":3,"archive_timestamp":"2026-03-10T14:51:18+00:00"},{"url":"https://www.nknews.org/2024/09/north-korean-cybercriminals-steal-22m-from-indonesian-crypto-exchange/","name":"","type":"other","archive_url":"http://web.archive.org/web/20260310145124/https://www.nknews.org/2024/09/north-korean-cybercriminals-steal-22m-from-indonesian-crypto-exchange/","credibility":3,"archive_timestamp":"2026-03-10T14:51:24+00:00"},{"url":"https://coinmarketcap.com/academy/article/indodax-crypto-exchange-suffers-major-hack-over-dollar22-million-in-losses","name":"","type":"other","archive_url":"http://web.archive.org/web/20260310145121/https://coinmarketcap.com/academy/article/indodax-crypto-exchange-suffers-major-hack-over-dollar22-million-in-losses","credibility":3,"archive_timestamp":"2026-03-10T14:51:21+00:00"},{"url":"https://www.merklescience.com/blog/hack-track-indodax-flow-of-funds-analysis","name":"","type":"other","archive_url":"http://web.archive.org/web/20260511062602/https://www.merklescience.com/blog/hack-track-indodax-flow-of-funds-analysis","credibility":3,"archive_timestamp":"2026-05-11T06:26:02+00:00"},{"url":"https://www.bitget.com/news/detail/12560604205326","name":"","type":"other","archive_url":"https://web.archive.org/web/20260830044950/https://www.bitget.com/news/detail/12560604205326","credibility":3,"archive_timestamp":"2026-08-30T04:49:50+00:00"},{"url":"https://www.bittime.com/en/blog/hacker-indodax-dan-bingx-diduga-hacker-korea-utara-lazarus-group","name":"","type":"other","archive_url":"https://web.archive.org/web/20260829185232/https://www.bittime.com/en/blog/hacker-indodax-dan-bingx-diduga-hacker-korea-utara-lazarus-group","credibility":3,"archive_timestamp":"2026-08-29T18:52:32+00:00"},{"url":"https://www.thecoinrepublic.com/2024/09/12/is-your-crypto-safe-indonesia-exchange-indodax-hacked-for-22m/","name":"","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://bitcoinethereumnews.com/crypto/indonesias-ojk-licenses-29-crypto-platforms-under-new-regulation/","name":"","type":"other","archive_url":"http://web.archive.org/web/20260107113516/https://bitcoinethereumnews.com/crypto/indonesias-ojk-licenses-29-crypto-platforms-under-new-regulation/","credibility":3,"archive_timestamp":"2026-01-07T11:35:16+00:00"},{"url":"https://ojk.go.id/en/fungsi-utama/itsk/perizinan-itsk-aset-keuangan-digital-aset-kripto/default.aspx","name":"","type":"other","archive_url":"http://web.archive.org/web/20260606163601/https://www.ojk.go.id/en/Fungsi-Utama/ITSK/Perizinan-ITSK-Aset-Keuangan-Digital-Aset-Kripto/Default.aspx","credibility":3,"archive_timestamp":"2026-06-06T16:36:01+00:00"},{"url":"https://www.digivestasi.com/news/detail/aset_kripto/indodax-finished-maintenance-user-funds-ensured-safe-services-return-to-normal?lang=eng","name":"","type":"other","archive_url":"https://web.archive.org/web/20260829151411/https://www.digivestasi.com/news/detail/aset_kripto/indodax-finished-maintenance-user-funds-ensured-safe-services-return-to-normal?lang=eng","credibility":3,"archive_timestamp":"2026-08-29T15:14:11+00:00"},{"url":"https://hacken.io/discover/lazarus-group/","name":"","type":"other","archive_url":"http://web.archive.org/web/20260608054821/https://hacken.io/discover/lazarus-group/","credibility":3,"archive_timestamp":"2026-06-08T05:48:21+00:00"},{"url":"https://www.halborn.com/blog/post/month-in-review-top-defi-hacks-of-september-2024","name":"","type":"other","archive_url":"http://web.archive.org/web/20260605230339/https://www.halborn.com/blog/post/month-in-review-top-defi-hacks-of-september-2024","credibility":3,"archive_timestamp":"2026-06-05T23:03:39+00:00"},{"url":"https://blockchaingroup.io/compliance-and-regulation/top-10-crypto-losses-of-2024-hacks-frauds-and-exploits/","name":"","type":"other","archive_url":"http://web.archive.org/web/20260215223932/https://blockchaingroup.io/compliance-and-regulation/top-10-crypto-losses-of-2024-hacks-frauds-and-exploits/","credibility":3,"archive_timestamp":"2026-02-15T22:39:32+00:00"}],"source_tags":["defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-04T02:54:29.514759+00:00","updated_at":"2026-08-30T05:14:06.740925+00:00"}}