KUALA LUMPUR – Indonesian cryptocurrency exchange platform Indodax has fallen victim to a major hacking incident, causing the popular space to suffer approximately US$20.58 million (RM89.1 million) in losses affecting tokens and currency.
The matter was first brought to light by crypto security firm Cyvers in an X post yesterday morning detailing that its system had detected “more than 150 suspicious transactions” involving Indodax’s wallets on different networks.
While the firm initially said the suspicious address held digital assets worth US$18.2 million, it was later reported that the firm increased the estimated losses associated with the attack to approximately US$20.58 million, as reported by Bitcoin.com News.
Cyvers artificial intelligence (AI) head Yosi Hammer was quoted as saying that over 160 critical red flags were raised during the attack, beginning with a transfer of 660 ethereum (ETH).
The attack, Hammer said, exhibited characteristics typical of sophisticated hacking groups such as North Korea-aligned Lazarus Group, which was previously linked to some of the biggest cyber thefts in the crypto scene.
He cautioned, however, that attributing blame for the attack is “still too early” at this stage.
While Lazarus Group is known to utilise a variety of techniques to exploit vulnerabilities in exchange systems, Cyvers believes that attack against Indovax is tied to an access control violation.
According to the security firm, ETH accounted for more than 60% (US$13.3 million) of the US$20.58 million losses while similar losses were recorded on Polygon (Matic) and Tron (TRX) at US$2.5 million each.
Bitcoin losses are estimated to stand at US$1.4 million while US$883,000 was lost via Optimism (OP).
Following Cyvers raising the alarm, Indodax had acknowledged the issue in postings on their social media platforms, confirming that its team had found “potential security indications” on its platform.
“We are currently carrying out thorough maintenance to ensure (our) whole system is working properly…don’t worry, we can make sure that your balance remains 100% secure both in crypto and rupiah,” it added.
As of press time and more than 24 hours since Indodax’s confirmation of security breaches, the platform’s website remains inaccessible, instead displaying a message apologising for the inconvenience due to ongoing “system updates”.
Indodax chief executive officer Oscar Darmawan was quoted by Investor Daily as saying today that the company is still conducting forensic security investigations, after which all services are expected to be restored.
Registered as a Crypto Asset Physical Trader under Indonesia’s Commerce Ministry’s Commodity Futures Trading Regulatory Agency, Indodax is understood to be used by 6.7 million people as of April this year.
The figure makes up for approximately 33% of the republic’s 20.16 million crypto investors. – September 12, 2024