Indodax Exchange Review: OG Score & Community Audit

Indodax is an established Indonesian exchange, but the 2024 hot-wallet hack is the main issue that cannot be ignored. More than $25M in assets were stolen, forcing the exchange to halt deposits and withdrawals while it responded to the breach. Even though customer balances were reportedly restored, the incident raises serious questions about wallet security and operational controls.
There are also regional limitations. Indodax is heavily built around Indonesia and IDR markets, making it less useful for international users. KYC restrictions, local tax requirements and banking dependencies add further friction.
User experience is another concern, with complaints around KYC delays, account restrictions, fees and platform performance during periods of heavy activity.

It's one of biggest exchange in Indonesia with millions of community but the 2024 hack caused significant damage to it's security and user base's trust even founder ensures user funds were safe, blockchain security firm Cyvers detected the unauthorized transactions and the exchange's CEO for the security firm suggested it may have involved access control issues or leaked private keys.
This wasn't its first security issue either in June 2023 police had already arrested two frauds who scammed users through fake social media links also the exchange seems outdated compared to newer exchanges users reported buggy and unresponsive tabs and features which makes it more frustrating for a trader.
It's an old exchange being with real user base but multiple security breaches and bad Ui has ruined it's reputation.

Indodax got hacked for $22 million in 2024, pledged to make users whole, and then spent the next two years apparently prosecuting the wrong person for it  its own witness in court identified a different attacker than the former intern the company charged. Meanwhile, Indonesian regulators are now examining whether Indodax's security fell short of mandatory standards at the time of the breach, turning "we got hacked" into "we may not have been compliant when we got hacked." Buried in the fine print: Indodax's Terms of Service let it freeze any user's withdrawals whenever it decides to, with zero compensation owed as long as it says it acted in good faith. A fast initial response in 2024 bought some goodwill. Everything uncovered since has spent most of it. 🥲

The repetitive $18M+ security breach and predatory fees are mot nrmal for a top tier exchange. It functions as a high risk Bridge, safe for quick Rupiah conversions, but dangerous for long term storage. This is the second major Lazarus linked hit in 18 months. While CEO Oscar Darmawan has guaranteed that user balances are "100% safe," the repeated failure to secure hot wallets even after the $22M hit in late 2024 indicates a systemic Expertise flaw in their security architectur https://www.binance.com/en/square/post/13434687357906 (Indodax Suspends Services After $22M Crypto Hack). https://legalindonesia.id/hackers-breach-indonesian-cryptocurrency-exchange-indodax/ (The march 11 2026 breach)

Indodax remains Indonesia’s largest licensed crypto exchange and a dominant fiat on-ramp for IDR traders. However, its reputation took a hit after a September 2024 hot-wallet exploit ~$20M that forced trading interruptions and raised concerns about internal security practices. The exchange claimed full reimbursement and no permanent user balance losses, but the incident exposed operational weaknesses. Community discussions on Reddit and X, and Trustpilot complaints, frequently mention withdrawal delays, sudden maintenance during volatility, and limited trading features compared with global competitors. Overall evaluation: reliable for local spot trading and fiat access for small/medium sized trades

Indodax rules as Indonesia's biggest regulated crypto spot They push steady listings, cheap USDT withdrawals lately, and no new hacks since the ugly 2024 breach ($18-22M hot wallet loss, which they patched and covered without mass user impact reported).

It's funny to hear that during pumps they use to go for maintenance 😁. What kind of maintenance is this. High level of complaints on missing $SOL, $BTC, $ETH etc, how can just assets disappeared from my wallet, this sound weird, this Indonesian exchange is something funny... I left...