Indodax suspended cryptocurrency and rupiah deposits and withdrawals on October 29 after detecting increased cyberattack attempts. CEO William Sutanto says customer assets remain secure, with
Indonesia’s largest cryptocurrency exchange, Indodax, suspended rupiah and cryptocurrency deposits and withdrawals on October 29 following an increase in cyberattack attempts. Co-founder and CEO William Sutanto described the shutdown as a precautionary measure, saying customer assets remain secure and no data breach has been detected.
The restrictions prevent customers from moving funds between Indodax, external wallets and bank accounts. The exchange has not provided a reopening deadline.
Indodax’s official operational status page recorded maintenance notices for four transaction services at 11:30 a.m. Western Indonesian Time (04:30 UTC) on October 29.
The dashboard also lists spot trading separately, but its displayed update for that service dates to October 1. That older timestamp does not independently confirm whether trading remained available during the latest security incident.
October 29, 2026 Indodax Service Status Reported maintenance and service availability Service Status / Last Update IDR Deposits Maintenance Oct 29, 11:30 WIB IDR Withdrawals Maintenance Oct 29, 11:30 WIB Crypto Deposits Maintenance Oct 29, 11:30 WIB Crypto Withdrawals Maintenance Oct 29, 11:30 WIB Spot Trading Unverified Oct 1, 18:00 WIB Source: Indodax official status page. Historical snapshot, not live data. Spot trading availability was not independently confirmed.The matching maintenance timestamps suggest that the exchange restricted multiple transfer functions as part of a coordinated security response rather than addressing an isolated cryptocurrency wallet issue.
For customers, the distinction between trading and transfers matters. Even if spot markets remain accessible, users may be unable to deposit additional collateral, move cryptocurrency to another platform or withdraw trading proceeds until the relevant services reopen.
In a statement on his official X account, Sutanto attributed the restrictions to heightened cyberattack activity and said the company was conducting security assessments and mitigation measures.
He linked the resumption of deposits and withdrawals to the completion of those checks, rather than committing to a specific maintenance period.
Indodax also addressed customers through its official X account, maintaining that rupiah and cryptocurrency balances remained protected.
However, the exchange has not identified the attackers, described the attempted intrusion methods or released an independent security assessment.
Its statements provide reassurance about the absence of detected losses, but they do not establish that the investigation has concluded. There is also no publicly confirmed evidence in the material reviewed that customer wallets were compromised during the October 29 disruption.
Indodax previously experienced a major security breach in September 2024, when blockchain investigators identified suspicious cryptocurrency transfers from exchange-associated wallets.
Security firm Cyvers estimated losses of approximately $20.5 million, while PeckShield initially identified suspicious outflows worth around $15.7 million.
The difference between those estimates reflected separate assessments as investigators examined the transactions.
Unlike the current situation, the 2024 incident involved observable on-chain asset movements that allowed researchers to identify potential losses.
The earlier breach explains why the exchange’s latest security measures deserve scrutiny, but it does not establish that the same vulnerabilities have returned.
The operational trade-off is also different from a completed theft. By disabling withdrawals during an investigation, an exchange can reduce the risk of further unauthorized transfers if a weakness exists. Customers, however, lose immediate access to assets held on the platform.
That makes the quality of the security review and the conditions for reopening more consequential than the length of the maintenance notice alone.
Customers concerned about their balances can review their account records while waiting for the transfer restrictions to be lifted.
Indodax provides a downloadable transaction archive covering deposits, withdrawals and trading activity.
According to the exchange’s official instructions, customers can access it through:
Users should select the relevant period and compare the downloaded records with their own transaction history. Unrecognized withdrawals, unexpected account changes or unfamiliar login activity should be reported through the Indodax Help Center.
Customers waiting to move funds should check the official operational status page before initiating transfers. The reopening of one service does not necessarily establish that every deposit or withdrawal method is available.
Indodax’s support guidance states that cryptocurrency deposits and withdrawals cannot be completed while the relevant wallet service is undergoing maintenance, and that the duration of such interruptions cannot always be predicted.
Users should also avoid unsolicited messages offering to accelerate withdrawals or restore account access. Indodax’s official guidance warns against sharing sensitive authentication information with individuals impersonating support personnel.
Indodax has not announced a confirmed reopening time.
Sutanto’s statement indicates that deposits and withdrawals will resume after the company determines its systems are safe. The exchange has not said whether rupiah and cryptocurrency transfers will return simultaneously or in stages.
The next substantive update will be whether investigators identify any compromised systems and which transaction services receive clearance to reopen.
For customers, the most important development is not simply the end of maintenance, but confirmation that transfers can resume without exposing funds to the threat that prompted the suspension.
The post Indodax Halts Crypto Withdrawals Amid Rising Cyberattack Attempts appeared first on ETHNews.
