Incident Overview
On September 10, 2024, Indonesian crypto exchange Indodax was hacked, resulting in the loss of approximately $22 million across multiple cryptocurrencies in a methodical attack targeting the exchange’s hot wallets.
The attack targeted Indodax's hot wallets, which store cryptocurrencies that are readily accessible for transactions. The hacker systematically breached Indodax's withdrawal system, allowing unauthorized transfers of funds across multiple blockchain networks. Assets were stolen from Bitcoin, Ethereum, Tron, Polygon, and Optimism, among others.
Security experts from firms like SlowMist and Cyvers suggest that the hacker exploited vulnerabilities in how Indodax processes withdrawals, potentially by manipulating signature verification mechanisms. After obtaining the funds, the hacker swiftly converted various tokens into Ethereum and began using Tornado Cash, a crypto-mixing service, to obscure the trail of the stolen assets. Despite the breach, Indodax's team acted quickly to suspend operations and limit further damage, though significant losses were already incurred.
The stolen funds were directed to the following wallets:
Bitcoin: bc1q5uqpn0ha5llrvhcvkq3nfalp8fj7qe3rydcvmf
Tron: TBooefeY6FvGuyKfvp5yE1HmzhzvXnvA1P
Ethereum/ERC-20: 0xb0a2e43d…bbcbed
Optimism: 0x3b8f1131…35eb6d
Polygon: 0x90fffbc0…5e904f
Ethereum (ETH): 0x59101e53…b48df8
Incident Report
Protocol Information
What the Attacker Needed to Succeed
Understanding the prerequisites for this type of attack helps auditors identify protocols that are most at risk and helps developers build better defenses.
What Auditors Should Check
If you're auditing a protocol with similar architecture to Indodax, these are the critical security checks that could have prevented this incident (September 2024).
- Verify all logic paths related to Access Control Exploit / Other are guarded by proper access controls and input validation - see the Access Control Attacks attack class for patterns
- Review privileged functions (owner, admin, governance) for potential abuse vectors - centralization risks should be documented and bounded with timelocks or multi-sigs
Master these auditing techniques with hands-on labs and real exploit scenarios in the Smart Contract Hacking course.
Free TrialRelated Attack Classes
The technique used in this hack maps to these vulnerability classes in our security curriculum:
Sources & References
Learn to Prevent the Next Indodax
The Indodax hack is one of many attacks that skilled auditors are trained to detect before deployment. Master real exploit patterns and defense techniques with hands-on Web3 security training.