Short answer
Indodax, Indonesia's largest crypto exchange, suspended rupiah and crypto deposits and withdrawals on 29 October 2026 after detecting a significant increase in cyberattack attempts. CEO William Sutanto said on 30 October that no funds or customer data were lost and extra security layers were added. No reopening date had been given.
If you think your details were included, start with our checklist on what to do after a data breach.
Key facts
| Organization | Indodax |
|---|---|
| Incident type | Data breach |
| Status | Under investigation |
| Sector | Crypto exchange |
| Country | Indonesia |
| Detected | 2026-10-29 |
| Disclosed | 2026-10-29 |
| People or records affected | Not stated. All users were affected by the pause on deposits and withdrawals. No data or fund loss has been reported by the company. |
What data was exposed
- None confirmed. Indodax says it found no unauthorized withdrawals and no customer data leak.
What happened
On Thursday 29 October 2026, Indodax announced it was temporarily suspending deposits and withdrawals of both rupiah and digital assets. It cited a “significant increase in cyberattack attempts”, according to Crypto Briefing, which put the start at about 12:24 WIB. Fiat and crypto transfers went offline. Spot trading stayed partly available and users could still see their balances.
CEO and co-founder William Sutanto called it a precaution. The company said its security team was reviewing the threat and strengthening the platform.
What the company says now
On Friday 30 October, Sutanto said the team had fixed all findings from its examination and added extra security layers, and wrote that customer funds and data “remain safe”, per CNBC Indonesia. Indodax reported no unauthorized transfers or withdrawals and no customer data leak. The pause had lasted more than a day by then. Sutanto apologised and said more checks must finish before services reopen. No date was given.
Why this is a “what we know” page
Neither report describes the attack method, names an attacker or gives an amount at risk. Neither mentions a statement from OJK, Bappebti or Komdigi. The claims of no loss and no leak come from Indodax and have not been checked by an outside party. We list no exposed data because none has been confirmed.
Context matters here. In September 2024 a hot-wallet compromise cost Indodax about 22 million US dollars, per Crypto Briefing. This time the company says the pause came before any money left.
What users should do while withdrawals are paused
A frozen exchange is where scammers show up. Expect accounts offering to “release” funds or messages from fake support staff. Read our guide to investment scams and recovery scams, which cover fake rescue services. Messages claiming your account needs “verification” follow the patterns in phishing messages. If you think your login was exposed, use our data breach checklist.
What is still unknown
Whether the attacks got into any system, whether any user data was touched, and when withdrawals return. We will update this page. Other cases are on our breaches page.
Scams to watch for after this breach
Criminals use breach news as cover. Expect messages that mention the incident, quote real details, or offer help.
- Fake Indodax support accounts on Telegram, WhatsApp and X offering to 'unlock' or 'speed up' your withdrawal for a fee or your seed phrase.
- Phishing sites and links claiming to be an Indodax 'security verification' or 'asset migration' page.
- Fake recovery services that promise to retrieve funds and ask for upfront payment.
- Impersonators claiming to be from OJK or the police and asking you to move crypto to a 'safe wallet'.
What to do if you are affected
- 01Use only Indodax's official website, app and verified social accounts for status updates. Ignore direct messages offering help.
- 02Never share your password, 2FA code, PIN or recovery phrase with anyone, including people who say they are Indodax staff.
- 03Turn on two-factor authentication and change your Indodax password, especially if you reuse it elsewhere.
- 04Check your account for unfamiliar logins or orders. If you see any, contact Indodax through its official support channel.
- 05Report fraud to the OJK consumer contact 157 or the OJK Indonesia Anti-Scam Centre (iasc.ojk.go.id). Check suspect account numbers at cekrekening.id.
Frequently asked questions
Was Indodax hacked in October 2026?
Indodax describes it as a rise in cyberattack attempts, not a successful theft. The company says it found no unauthorized withdrawals and no customer data leak. That has not been independently verified.
Is my money on Indodax safe?
Indodax's CEO said customer funds and data remain safe. Deposits and withdrawals were paused for over 24 hours as of 30 October, with no reopening date given.
Why can't I withdraw from Indodax?
Indodax suspended rupiah and crypto deposits and withdrawals on 29 October as a precaution while it checks and secures its systems. Follow its official channels for the restart.
Has Indodax been hacked before?
Crypto Briefing reports that a hot-wallet compromise in September 2024 caused losses of about 22 million US dollars. The 2026 pause happened before any funds left, according to the same report.
How do I avoid scams during the Indodax pause?
Ignore anyone offering to unlock withdrawals. Indodax will not ask for your recovery phrase or 2FA code. Report fraud through OJK 157 or iasc.ojk.go.id.
Sources
- Bursa Indodax Diserang Hacker, CEO Jelaskan Kondisi Dana Nasabah (Indodax exchange attacked by hackers, CEO explains customer funds), CNBC Indonesia, 2026-10-30
- Indodax suspends deposits and withdrawals amid cyberattack attempts, Crypto Briefing, 2026-10-29
This post summarises public reporting as of 2026-10-30. Details of live incidents change; we update posts when the organization or regulators publish new facts. Spot an error? See our editorial and corrections policy.