Largest crypto exchange in Indonesia pledges to reimburse users after $22 million theft

Siva Ramakrishnan
A major cryptocurrency exchange in Southeast Asia has paused operations after $22 million in coins was stolen this week.

A major cryptocurrency exchange in Southeast Asia has paused operations after $22 million in coins was stolen this week.

Jakarta-based Indodax, which says it has more than 6 million users, told customers that it discovered a security issue on its platform and has shut down its service while it “completes maintenance to ensure the entire system is operating properly.”

The company did not respond to requests for comment about how much was lost but shared a post from another news outlet saying $22 million was lost. 

They pledged to compensate any users who may have had funds stolen, and in a follow-up statement warned customers of scammers attempting to use the situation to steal even more cryptocurrency. 

“Please be careful of fraud in the name of INDODAX! We inform you to be careful of INDODAX fund refund invitations or requests for your personal data,” they said

“INDODAX will run normally again as soon as the maintenance is complete.”

Several blockchain security firms said they began seeing funds flow out of the platform on September 10, including 25 Bitcoin worth about $1.4 million and $14 million worth of ethereum.

Indodax has operated since 2014 and is the latest in a string of large cryptocurrency platforms in Asia to face attack. 

At least $230 million worth of cryptocurrency was stolen from an India-based cryptocurrency platform named WazirX in July. Last week, a large platform in Singapore was also attacked, with more than $27 million stolen

While none of the attacks have been attributed, both the FBI and Microsoft have released multiple reports over the last month that said hackers connected to the North Korean government have made a point of going after cryptocurrency companies with a variety of different attacks. 

North Korea’s government has made hacking cryptocurrency platforms a key pillar of its revenue strategy, netting $3 billion from attacks between 2017 and 2023, according to United Nations investigators. White House officials have warned that the money is used to fund the country’s nuclear weapons program.

CybercrimeIndustryNewsNews Briefs
Get more insights with the

Recorded Future

Intelligence Cloud.

Learn more.

No previous article

No new articles

Jonathan Greig

is a Breaking News Reporter at Recorded Future News. Jonathan has worked across the globe as a journalist since 2014. Before moving back to New York City, he worked for news outlets in South Africa, Jordan and Cambodia. He previously covered cybersecurity at ZDNet and TechRepublic.

 

Total
0
Shares
Previous Post

New Android malware targets bank customers in Central Asia

Next Post

Multiple attacks forces CISA to order agencies to upgrade or remove end-of-life Ivanti appliance

Related Posts

Critical Windows Server 2025 dMSA Vulnerability Enables Active Directory Compromise

A privilege escalation flaw has been demonstrated in Windows Server 2025 that makes it possible for attackers to compromise any user in Active Directory (AD). "The attack exploits the delegated Managed Service Account (dMSA) feature that was introduced in Windows Server 2025, works with the default configuration, and is trivial to implement," Akamai security researcher Yuval Gordon said in a
Avatar
Read More

Critical RCE Flaws in Cisco ISE and ISE-PIC Allow Unauthenticated Attackers to Gain Root Access

Cisco has released updates to address two maximum-severity security flaws in Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) that could permit an unauthenticated attacker to execute arbitrary commands as the root user. The vulnerabilities, assigned the CVE identifiers CVE-2025-20281 and CVE-2025-20282, carry a CVSS score of 10.0 each. A description of the defects is
Avatar
Read More

Update ASAP: Google Fixes Android Flaw (CVE-2025-27363) Exploited by Attackers

Google has released its monthly security updates for Android with fixes for 46 security flaws, including one vulnerability that it said has been exploited in the wild. The vulnerability in question is CVE-2025-27363 (CVSS score: 8.1), a high-severity flaw in the System component that could lead to local code execution without requiring any additional execution privileges. "The most severe of
Avatar
Read More