The archive · Money & Fintech · Strategic decision · 2014–2024
Indodax's trust bet: $22M hack, 80-hour recovery, then record volume
Indonesia's top crypto exchange bet Rupiah-first local trust would win retail; a $22M hot-wallet hack in Sept 2024 tested it, and trading rebounded.
Indodax
What the business is
Indodax runs Indonesia's largest crypto exchange, letting retail investors buy, sell and withdraw Bitcoin, Ethereum and hundreds of other tokens in Rupiah.
How it started
Indodax grew into Indonesia's dominant crypto exchange by making Rupiah deposits, trading and withdrawals simple for local retail investors — a local-first trust position that made it a household name in Indonesian crypto long before the September 2024 hack.
What happened
On 11 September 2024, blockchain investigators PeckShield, Cyvers and SlowMist flagged an attack on Indodax's hot wallets. Roughly $22M in Bitcoin, Ether, TRX, POL and ERC-20 tokens was drained — $1.42M in BTC, $2.4M in TRX, over $14.6M in ERC-20 tokens, $2.58M in POL and $900K in ETH — and Indodax took its web and mobile apps offline to investigate, saying user assets were safe. Cyvers suspected North Korea's Lazarus Group based on the attack pattern.
How it ended up
Indodax recovered in about 80 hours: maintenance ran 14–17 September, after which trading resumed. CEO Oscar Darmawan reported Rp547 billion of trading volume in the days after relaunch, no user panic, and reserves exceeding 100% of user balances, with published proof-of-reserve.
Background
Indodax is Indonesia's largest crypto exchange, a Rupiah-first platform that built its position by making deposits, trading and withdrawals feel like a local bank. That local trust was the business: TokenPost called it 'Indonesia's top crypto exchange' when trouble came.
On 11 September 2024, blockchain investigators PeckShield, Cyvers and SlowMist flagged an attack on Indodax's hot wallets. Hackers drained roughly $22M across Bitcoin, Ether, Tron, Polygon and ERC-20 tokens — including over $14.6M of ERC-20 assets — and Indodax took its web and mobile apps offline to investigate. Cyvers suspected North Korea's Lazarus Group from the attack's pattern.
The exchange recovered in about 80 hours. After maintenance from 14 to 17 September, trading resumed; CEO Oscar Darmawan said the platform saw Rp547 billion in trading volume in the following days, no user panic, and reserves exceeding 100% of user balances, backed by a published proof-of-reserve report.
What has to be true
- Indodax's bet was that Indonesian retail crypto belonged to the local, Rupiah-first exchange — a trust advantage over global rivals that no feature set could replicate.
- The $22M hack was the sharpest test of that bet: the damage happened in minutes, but the survival question was about user trust, not about the stolen tokens.
- Reserves above 100% of user balances turned the crisis into evidence: the exchange could point to proof-of-reserve and say the breach didn't cost users anything.
- Fast, transparent recovery (about 80 hours) plus rising post-hack volume showed that for a local trust franchise, surviving a breach can strengthen the brand.
What can be applied
When the product is trust, the breach response is the product: Indodax survived because reserves exceeded 100% and communication was fast — the hack became proof of resilience, not failure.
Aftermath
As of 20 September 2024, Indodax was fully operational again, with trading volume of Rp547 billion recorded in the days after maintenance ended and total crypto reserves of Rp11.5 trillion, which the company said exceeded 100% of user balances. It published proof-of-reserve data and coordinated with Indonesian regulators and security agencies during the incident. The hack was widely attributed to North Korea's Lazarus Group, though no official attribution was confirmed in the sources reviewed.
Sources
- Indonesian crypto exchange Indodax goes offline after suspected $22M hack
- Indodax Hack: $22M Stolen in Massive Breach, Indonesia's Leading Crypto Exchange Shuts Down
- Transaksi Kripto Pulih, Ini Lokasi Penjahat Siber Indodax
spotted an error? The archive wants to know.
Your turn
You just read one. Describe what you are building, and see who is betting on the same thing.
Free account · 3 free questions · no card