Indodax

Is Indodax safe?

Indodax is a regulated exchange with a real hack on its record. It holds a licence from Indonesia's financial regulator, OJK, which puts it ahead of the offshore platforms that many Indonesians also use. But in September 2024 attackers drained its hot walletsHot walletA crypto wallet connected to the internet, such as an app or an exchange's online wallet. It is convenient, but more exposed to hacking.More in the glossary of about $22 million, and its reserve data proves less than the name suggests. We score it 57/100, a little above BtcTurk, which lost more in two hacks, and well above WazirX, whose users were not made whole.

Indodax is by far the biggest exchange in Indonesia. OJK counted 21.37 million crypto users in the country in March 2026, and Indodax says 9.9 million of them, about 46.5%, are its customers.

What happened in the 2024 hack?

On 10 and 11 September 2024, blockchain monitoring firms including PeckShield, Cyvers and SlowMist flagged large outflows from Indodax's hot walletsHot walletA crypto wallet connected to the internet, such as an app or an exchange's online wallet. It is convenient, but more exposed to hacking.More in the glossary on Bitcoin, Ethereum, Tron, Polygon and Optimism. Cointelegraph put the loss at about $22 million; the analytics firm Merkle Science counted more than $25.47 million, most of it tokens on Ethereum. The attacker swapped stolen tokens for ETH, POL and TRX rather than stablecoins, which Merkle Science linked to Tether's habit of freezing stolen USDT.

The cause was never fully published. SlowMist said the hot-wallet keys did not seem to be compromised and pointed to the withdrawal system instead; Cyvers suspected a signing machine and said the attack "highly" resembled North Korea's Lazarus Group. That is the analyst's view, not a government attribution.

Indodax shut its website and app for a full system check and told users their assets were safe. We found no reports of customers being left with losses from the hack, which is why security scores in the low 60s rather than lower. The weak part is the explanation: there is no public post-mortem.

Is Indodax licensed by OJK?

Yes. Crypto supervision in Indonesia moved from the commodity-futures regulator Bappebti to OJK in January 2025. OJK's whitelist of December 2025 names PT Indodax Nasional Indonesia as a licensed digital financial asset trader, licence S-18/D.07/2025 dated 1 February 2025, at an address in South Jakarta. OJK says anyone trading outside the whitelist has no regulator behind them, and unlicensed operators face five to ten years in prison under the 2023 financial sector law.

The licence covers Indonesia only. Indodax is not on the EU's MiCAMiCAThe EU's Markets in Crypto-Assets Regulation, which requires crypto exchanges and other providers to be licensed and supervised.More in the glossary register or authorised in the UK, US or Japan, so it scores in the middle on licensing rather than high.

Proof of reserves: what it shows and what it does not

Indodax publishes its wallet addresses through CoinMarketCap's proof-of-reservesProof of reservesA report in which a crypto exchange shows that it holds enough coins to cover all customer balances, ideally checked by an outside firm.More in the glossary feature, and said in January 2026 that those wallets held more than $1 billion (about Rp 18 trillion). Anyone can check the balances on-chain. What is missing is the other side: Indodax does not publish what it owes customers or a Merkle treeMerkle treeA way to combine many records into one short code, so that each person can check their own record is included without seeing anyone else's.More in the glossary that lets you confirm your own balance was counted, and no auditor or security firm signs off. CoinDCX, for comparison, publishes reserves against user liabilities in a statement checked by its auditor. Without liabilities, a large wallet balance does not prove the exchange is fully backed.

User complaints and the OJK review

In June 2025 a user said on X that money had disappeared from an Indodax account without any notification. Indodax's chief executive, William Sutanto, proposed an audit of the exchange to settle the matter. In January 2026 OJK's head of crypto supervision, Hasan Fawzi, said the case was still being traced because the parties gave different accounts, and that OJK was auditing all licensed traders and the CFX exchange as part of routine supervision. Separately, some users have complained about accounts being closed. OJK held mediation in December 2025, according to press reports.

A criminal trial over alleged illegal access to Indodax's servers was also under way at the South Jakarta District Court in July 2026. Indodax is the alleged victim in that case, not the defendant. None of this is an enforcement action against the company, but it is worth watching.

How to use Indodax more safely

1. Check that you are on indodax.com or the official app listed on OJK's whitelist; OJK warns about look-alike domains.
2. Turn on authenticator-app 2FATwo-factor authenticationSigning in with a second proof of identity on top of your password, such as a code from an app, a security key or a passkey.More in the glossary and do not rely on SMS codes alone.
3. Keep only the rupiah and coins you are trading on the exchange, and move larger holdings to a wallet you control.
4. Screenshot balances and keep transaction records, so any complaint to OJK has evidence behind it.
5. If something goes wrong, complain to Indodax first and then to OJK's consumer channel; this route does not exist on unlicensed platforms.

How we scored it

Legal record (75) is Indodax's strongest factor: we found no fines or enforcement against the company. Proof of reservesProof of reservesA report in which a crypto exchange shows that it holds enough coins to cover all customer balances, ideally checked by an outside firm.More in the glossary (42) is its weakest, because the wallet list has no liabilities and no auditor. Security history (62) reflects a $22 million hack with no reported customer losses but no public post-mortem, and licensing (55) a full OJK licence that covers Indonesia only.