Indodax#2

Date (as written): 2024-09
Year: 2024
Country: Indonesia
Actors (as written): Lazarus
Actor pages: Lazarus
Tags (as written): Cryptocurrency FinancialGain
Dollar figures (as written): $25 million; $400 million; USD 20 million; USD 20 Million; $22,000,000; 22 ($ Million)

Source entries (5)

lazarus.day

Indodax#2 · 2024-09

On September 10, 2024, Indonesia's largest crypto exchange, Indodax, lost over $25 million in a sophisticated hack. Attackers exploited the exchange's withdrawal system, siphoning funds across multiple blockchains, including Ethereum, Bitcoin, Polygon, and Tron. While the exact identity of the attackers remains uncertain, some experts suspect the involvement of North Korea's Lazarus Group. Indodax assured users that their funds were safe, despite the breach. The stolen assets were redistributed through various wallets, but the exchange still holds over $400 million in other assets.

https://lazarus.day/incidents/indodax2/

EuRepoC

Hackers likely from DPRK Stole Around USD 20 Million in Cryptocurrencies from Hot Wallets of the Indonesian Cryptocurrency Trading Platform Indodax since at least 10 September 2024 · 10.09.2024

Hackers which are likely from DPRK stole approximately USD 20 million in cryptocurrencies from hot wallets of Indoensian cryptocurrency trading platform Indodax since at least 10 September 2024, Indodax first reported in the early morning of 11 September 2024. Some observers of the cryptocurrency scene on X also reported on the same day that the hackers began converting the stolen cryptocurrencies into established cryptocurrencies. The observers also put forward various theories as to how this cyber incident could have come about, including the compromise of the withdrawal system or the signature machine. According to the co-founder of Indodax the attackers exploited a vulnerability to gain access. The long disruption of the Indodax platform is due to maintenance measures, ensuring that no more exploits exist in their systems. Additionally, the CEO stated in a written statement that an analysis conducted by a crypto security agency indicated that the attack was (perpetrated) by an actor affiliated to the DPRK (Democratic People's Republic of Korea).

Sources cited by EuRepoC (7)

https://kriptokoin.com/borsa-hacklendi-5-altcoin-calindi/

https://cointelegraph.com/news/indodax-crypto-exchange-hacked-22-million-loss

https://x.com/CyversAlerts/status/1833629057256239175

https://x.com/SlowMist_Team/status/1833707952353812782

https://x.com/indodax/status/1833681240735760633

Show 2 more

https://en.antaranews.com/news/325999/north-korea-affiliated-actor-likely-hacked-crypto-exchange-indodax

https://therecord.media/japanese-crypto-service-shuts-down

tayvano/lazarus-bluenoroff-research

Indodax · 2024-09-10

Amt Stolen: $22,000,000

https://github.com/tayvano/lazarus-bluenoroff-research/blob/main/hacks-and-thefts/indodax_2024.md

Multilateral Sanctions Monitoring Team (MSMT) report, 22 Oct 2025

Indodax · 2024-09-10

Table 2: DPRK Cryptocurrency Thefts, January - December, 2024. Date: 2024-09-10; Victim: Indodax; DPRK APT: TraderTraitor; Amount ($ Million): 22. Report: "In coordination with Chainalysis and Mandiant, MSMT Participating States have attributed the cryptocurrency heists in tables 2 and 3 to DPRK actors."

https://github.com/tayvano/lazarus-bluenoroff-research/blob/main/pdfs/2025-10-22_MSMT-Report.pdf

SlowMist 2024 Blockchain Security and Anti-Money Laundering Annual Report, section 3.3 DPRK (table 'attributed to DPRK-affiliated groups, with data from SlowMist Hacked')

Indodax · Sep-10, 2024

The following is a chronological list of significant incidents attributed to DPRK-affiliated groups, with data from SlowMist Hacked: ... Sep-10, 2024 Indodax $22,000,000

https://www.slowmist.com/report/2024-Blockchain-Security-and-AML-Annual-Report(EN).pdf

Suggest a correction on GitHub