Indonesia-based Indodax temporarily suspended deposits and withdrawals after detecting more cyberattack attempts. Its CEO says the team is rechecking systems; the official status page lists trading as operational.
Indonesia-based crypto exchange Indodax temporarily suspended deposits and withdrawals on October 29 after detecting an increase in cyberattack attempts. In his statement at 06:23 UTC, CEO William Sutanto said his team was checking the systems and taking steps to reduce the risk of an attack. Services would reopen only after the team was confident they were safe.
Sutanto said member assets were safe and no unauthorized withdrawals or data leak had been found. The company did not identify the systems targeted or the methods the attackers tried.
Rupiah and crypto transfers under maintenance
At 13:16 UTC on October 29, Indodax’s official status page listed rupiah deposits, rupiah withdrawals, crypto deposits and crypto withdrawals as under maintenance. The four service entries were last updated at 11:30 WIB, or 04:30 UTC, that day. The company did not give an exact start time for the attack attempts or the suspension across all customers.
| Service | Displayed status | Entry last updated |
|---|---|---|
| Rupiah deposits and withdrawals | Both under maintenance | October 29, 04:30 UTC |
| Crypto deposits and withdrawals | Both under maintenance | October 29, 04:30 UTC |
| Crypto trading | Operational | October 1, 11:00 UTC |
The same page listed trading, recurring investment, the website, mobile app and live customer support as operational. However, the services needed to move money to a bank account or crypto to an external wallet were suspended.
Two of the six maintenance entries in the page’s summary were staking and Quick Buy USDT. Both entries were last updated on October 1. Indodax did not link their maintenance to the October 29 attack attempts. The page listed 12 other services as fully operational and none as partially operational.
CEO reports no unauthorized withdrawals or data leak
In its initial announcement at 05:24 UTC, Indodax said rupiah and crypto balances remained safe during maintenance, without detailing attack attempts. Sutanto later said the team had detected more cyberattack attempts and stopped transfers for security reasons.
In an update at 08:38 UTC, the CEO said his team was rechecking systems as a precaution. They wanted to ensure the systems used to detect attacks met strict security standards. He also reiterated that member assets remained intact. He did not say when the checks would be completed.
In its 08:45 UTC update, Indodax said the team was still maintaining and periodically checking the deposit and withdrawal systems. It did not announce a firm reopening time, the order in which services would resume or when pending transfers would be completed.
Customers whose crypto assets are held by an exchange request withdrawals from the platform instead of transferring them directly with their own keys. With Indodax’s withdrawal service suspended, moving those balances to another account depends on maintenance ending. The company did not report a halted blockchain network, confirmed customer losses or a compensation program.
Official updates and fake-support risks
In a separate post dated October 28, Indodax warned about phishing and urged users to deal only with official customer support and keep personal information, passwords and one-time verification codes private. The company did not connect the previous day’s general warning to the October 29 attack attempts.
The exchange’s official website lists support@indodax.com and (021) 5065-8888 as support contacts. Service updates are available through its official status page and @indodax account. If someone claiming to be a support agent sends a message, verify the account through an official channel independently of any link in that message.
The segment beginning at 00:46 in Indodax’s July 7, 2026 video covers fake Telegram administrators and phishing links promoted with a 100% cashback offer. The July recording explains scams targeting users; it does not cover the October 29 incident.
Sutanto’s initial security statement from October 29 appears below.
