Indodax kept $22M in hot wallets — a single breach drained six chains at once

Indodax, Indonesia's largest cryptocurrency exchange with more than 6 million users, ran hot wallets — internet-connected wallets used to fund everyday withdrawals — holding tens of millions of dollars across several blockchains. On September 11, 2024, attackers pushed through more than 150 suspicious transactions and drained roughly $22 million: about $14.6 million in ERC-20 tokens, $2.58 million in Polygon assets, $2.4 million in Tron, $1.42 million in Bitcoin and smaller amounts in Ethereum on Optimism.

Indodax took its web and mobile apps offline the same day, calling it "complete maintenance," and told users their remaining balances were still fully backed. Blockchain-forensics firms tracking the stolen funds — Cyvers, SlowMist and PeckShield among them — said the attack pattern and the way proceeds were laundered through swaps into ETH, TRON, Polygon and Bitcoin closely resembled North Korea's Lazarus Group, the actor blamed for the WazirX and Bybit exchange hacks. No party has taken credit and Indodax has not confirmed the attribution.

Indonesia's derivatives regulator, Bappebti, summoned Indodax for an explanation and told customers to stay calm while it monitored the exchange's response. Indodax said it held roughly $369 million in reserves — over ten times the stolen sum — and pledged to make affected users whole from that cushion rather than pass the loss on to them.

Attackers drained $22M across Bitcoin, Ethereum, Tron and Polygon in one breach; Indodax pledged to cover losses from $369M reserves.

Tens of millions of dollars sat in hot wallets — reachable over the internet for routine withdrawals — instead of the cold, offline storage exchanges use for the bulk of customer funds.

Balances were split across six different blockchains inside those hot wallets, so one compromised access point could drain Bitcoin, Ethereum, Tron and Polygon holdings in the same run of transactions.

More than 150 transactions went out before Indodax noticed and pulled its platform offline, pointing to monitoring that caught the breach only after the funds were already moving.

Money kept reachable for withdrawals is money reachable to an attacker. The less an exchange keeps hot, and the fewer chains behind one wallet, the less a single breach can take.

Indodax restored its platform after taking it offline for maintenance and said it would cover user losses from its own reserves. Bappebti kept the exchange under review, and Indonesian legal commentators argued the breach itself showed Indodax had fallen short of the system-reliability standards Bappebti and the OJK require of licensed crypto platforms.