INDODAX | $25 Million Dollar Hack

On September 10th, 2024, Indodax, Indonesia’s largest crypto exchange, fell victim to a highly sophisticated $25 million hack, marking one of the most significant breaches in the crypto space this year. The attack has raised critical concerns about the security vulnerabilities in crypto exchanges and the evolving tactics of hackers. Early warnings came from Cyvers, a cybersecurity firm that detected suspicious transactions involving multiple wallets across various networks. The crypto community quickly mobilized as blockchain sleuths began investigating the breach.

Stolen Funds Overview

The total estimated losses from the Indodax hack are around $25.22 million, with the stolen assets spread across multiple cryptocurrencies:

• 6.14M USDT
• 1,047 ETH (valued at $2.48 million)
• 25 BTC (worth approximately $1.41 million)
• 2.2M MATIC (valued at $849,000)
• 1.4M ARB (worth $749,600)
• 2M ENA (valued at $465,000)

These numbers paint a stark picture of the attack’s scale, with various tokens stolen across networks like Ethereum, Polygon, and Tron.

Emerging Patterns in the Attack

While details of the attackers remain unconfirmed, Yosi Hammer, the Head of AI at Cyvers, noted that the hack showed patterns similar to North Korea’s Lazarus Group, a notorious hacking organization responsible for multiple high-profile crypto heists. However, Hammer emphasized that it’s still too early to definitively identify the attackers.

SlowMist Analysis: A Complex Attack on Indodax

According to SlowMist, a blockchain security firm, this breach wasn’t a simple hot wallet compromise. Instead, it was a sophisticated attack on Indodax’s withdrawal system. The hackers managed to make their withdrawals appear legitimate by linking change addresses directly to Indodax, making detection more challenging.

This attack highlights the need for better security measures in exchange withdrawal protocols, especially as hacking sophistication continues to grow.

Compromised Indodax Hot Wallets

The breach impacted multiple hot wallets on different blockchain networks, including:

Ethereum/Polygon wallet: 0x3C02290922a3618A4646E3BbCa65853eA45FE7C6
Tron wallet: TWe5pEnPDetzxgJS4uN26VFg15wWtdcTXc
Bitcoin wallet: 1JUToCyRL5UwgeucjnFAagKs4v1YqhjT1d
These wallets were used to orchestrate the transfers across various chains, further complicating the process of tracking the stolen assets.

Indodax Response to the Hack

Following the attack, Indodax swiftly took action, announcing “complete maintenance” to ensure system integrity and prevent further breaches. William Sutanto, co-founder of Indodax, assured users that their funds, both in crypto and rupiah, were safe. The exchange has focused on improving its security protocols in the wake of this breach, though it remains to be seen how long it will take to fully restore operations.

Hackers’ Next Moves: Tracing the Stolen Funds

In an attempt to evade detection, the hackers transferred the stolen assets across multiple platforms and networks, including:

• Ethereum: $12.37 million
• Miscellaneous ERC-20 tokens: $1.2 million
• Optimism: $900,000
• Polygon: $6.8 million
• Tron: $2.55 million
• Bitcoin: $1.4 million

By spreading the funds across these chains, the attackers made it harder for authorities to track and recover the stolen assets. Cyvers has identified over 150 transactions related to the attack, and the investigation remains ongoing.

Ongoing Investigation and Past Security Issues

This incident is not the first time Indodax has encountered security issues. In June 2023, Indonesian authorities arrested two individuals who had been impersonating Indodax, leading to the theft of 625 million Rupiah. While unrelated to the recent attack, the past breach underscores the ongoing challenges crypto exchanges face when it comes to security.

The investigation into this recent attack is far from over. A detailed post-mortem report is expected in the coming weeks, which should shed more light on how the hackers infiltrated Indodax’s systems and what steps the exchange plans to take moving forward.

Key Takeaways

Despite this significant breach, Indodax still holds over $400 million worth of tokens. The attack serves as a stark reminder of the inherent risks and vulnerabilities within the cryptocurrency industry, particularly when it comes to exchanges managing large amounts of liquidity.

Security vs. Liquidity: This breach highlights the security versus liquidity challenge that continues to plague crypto exchanges. As the sophistication of hacking attempts grows, exchanges must continuously evolve their security measures.

Stricter Withdrawal Controls: The attack on Indodax suggests that crypto platforms need to adopt stricter withdrawal protocols and enhance hot wallet protection to safeguard against similar breaches in the future.

Conclusion and Broader Implications

Indodax now joins a growing list of crypto exchanges that have fallen victim to digital heists. As the threat landscape in the crypto space continues to evolve, both users and exchanges must stay vigilant. For users, it’s essential to question: Is your exchange secure, or could it be the next to fall?

This breach serves as a critical lesson in the importance of cybersecurity for the rapidly growing crypto market. Moving forward, crypto exchanges must not only focus on growth but also ensure that their systems are robust enough to withstand increasingly sophisticated attacks.