Indodax review.

Overview

Indodax is Indonesia’s oldest and largest crypto exchange, run by PT Indodax Nasional Indonesia from the Millennium Centennial Center on Jalan Jenderal Sudirman in South Jakarta. It opened in 2014, its own newsroom page names Oscar Darmawan and William Sutanto as founders with Sutanto now chief executive, and on 12 August 2026 its public pairs API served 506 markets across 497 distinct coins. Everything settles in rupiah or USDT, and there is no margin, no futures and no leverage anywhere on the platform.

The fact worth knowing before any other is that Indonesia moved crypto supervision from BAPPEBTI, the commodity futures regulator under the Trade Ministry, to OJK, the financial services authority, under Law 4 of 2023, with the transfer taking effect in January 2025. Those are two different regimes and a firm can hold a permission from either, or sit between them. Indodax is on the OJK side. We confirmed its permission on OJK’s own published register and in OJK’s own press release, and the number and date match what Indodax prints about itself.

What that permission does not buy is the thing most readers assume. There is no deposit insurance, no investor compensation scheme, and the binding user agreement contains no promise that client coins are held separately from the company’s own. Indodax holds the coins. The September 2024 theft, set out with dates further down, is what that arrangement looks like when it fails.

Overview Table

Facts List

• The legal counterparty is PT Indodax Nasional Indonesia. One company, named identically on the site, the agreement, both regulators’ registers and both ISO certificates, and no second entity appears anywhere in what we fetched. We did not search a corporate registry, so this rests on website and regulator evidence rather than on company filings.
• OJK permission S-18/D.07/2025 dated 1 February 2025 appears on OJK’s register of digital financial asset trading operators at position 25 May 2026.
• The same permission appears in OJK press release SP 226/GKPB/OJK/XII/2025 of 19 December 2025, which published a whitelist of licensed and registered operators.
• Exchange membership of CFX, the licensed crypto bourse, under SPAB-020/PFAK/CFX/10/2024, confirmed on CFX’s own member register as Certified.
• Clearing membership of PT Kliring Komoditi Indonesia, confirmed on the clearing house’s own members page. Indodax cites the number KKI/SPAK-020/X/2024 of the same date; KKI publishes no numbers.
• Trading fee on rupiah markets is 0.10% maker and 0.20% taker, published per pair in the public API, against 0.03% and 0.06% on USDT markets.
• The CFX levy on top is 0.0111% on rupiah markets and 0.0222% on USDT markets, cut from double those rates on 1 March 2026.
• Rupiah withdrawal costs a flat Rp 10,000, plus Rp 1,000 if you verify by SMS.
• The only accountant verified proof of reserves is a Kreston Indonesia letter measured at 31 January 2023. The current claim, from January 2026, rests on a self submitted wallet listing on a market data site.
• The ISO 27001 and ISO 9001 certificates are real and current on BSI’s own directory, but both are scoped to customer data management rather than to wallet or asset security.

Key Takeaways

• The licence is real, current, and we checked it at the regulator. OJK’s own register of digital financial asset trading operators, at position 25 May 2026, carries PT Indodax Nasional Indonesia with permission S-18/D.07/2025 dated 1 February 2025. So does OJK’s whitelist press release of 19 December 2025. Indodax quotes the same number on its own newsroom page.
• Two regulators, one firm, and they are not the same thing. BAPPEBTI issued physical crypto trader licence 10/BAPPEBTI/PFAK/12/2024 on 27 December 2024, two weeks before supervision passed to OJK, and that licence is still published on BAPPEBTI’s list today. The OJK permission is the one that governs now.
• Exchange and clearing membership are not custody protection. Certified membership of CFX and of the clearing house is a market structure requirement. It is not a licence to hold client money and it is not evidence that anybody other than Indodax is holding your coins.
• Nobody insures your balance. The user agreement carries no segregation clause, names no third party custodian, and mentions insurance only to say that crypto is not insured by any central authority.
• Proof of reserves changed shape without anyone saying so. The only accountant verified evidence is a cover letter measured at 31 January 2023, which predates the September 2024 theft. A blog post of 6 January 2026 says member assets are “100% aman” and points at a market data site whose reserve figures the exchange submits itself, and whose profile text is Indodax’s own copy.
• The ISO 27001 badge does not cover your coins. BSI’s own register gives the scope as customer data management on crypto asset exchange services.
• Fees are published where most people never look. Every pair in the public API carries its own maker and taker rate. The help centre article that would explain maker and taker serves a sign in page instead.
• Rupiah or nothing. There is no USD rail, and a foreign national living abroad can open an account but cannot lift the default limits without an Indonesian residence permit.
• Two products were shut when we looked. Staking and Quick Buy USDT were both under maintenance with no end date given on 12 August 2026.

Licences & Custody

Indonesia rewrote who supervises crypto. Law 4 of 2023 on the development and strengthening of the financial sector moved digital financial assets, crypto included, from BAPPEBTI under the Trade Ministry to OJK, the financial services authority, and the transfer took effect in January 2025. OJK’s implementing rule is POJK 27 of 2024 on operators of digital financial asset trading, since amended by POJK 23 of 2025 with effect from 10 November 2025, and supplemented by POJK 30 of 2025 on governance and risk management. Anyone citing 27 of 2024 unamended, as a good deal of commentary still does, is citing a superseded text. A firm licensed under the old regime was a Pedagang Fisik Aset Kripto. Under the new one it is a Pedagang Aset Keuangan Digital. Those are different permissions from different authorities and treating them as interchangeable is the main way a reader gets misled about an Indonesian exchange.

Indodax holds both, in sequence, and we verified each at its own source rather than taking the firm’s word for it.

On the OJK side the evidence is a register, not a press statement. OJK publishes a PDF list of operators, and the current one, “Daftar Penyelenggara Perdagangan Aset Keuangan Digital Posisi 25 Mei 2026”, names PT Indodax Nasional Indonesia (Indodax) with S-18/D.07/2025 (1 Februari 2025) under the heading Pedagang Aset Keuangan Digital. The same entry appears in OJK press release SP 226/GKPB/OJK/XII/2025 of 19 December 2025, which announced a whitelist and told the public in plain terms that anyone not on it is not licensed and not supervised by OJK.

One nuance the numbering makes visible. Every incumbent on that list carries an S prefixed letter dated 1 February 2025, while firms authorised later carry KEP prefixed decisions with their own dates, such as Luno’s KEP-17/D.07/2026 of 25 May 2026. Indodax is in the first group. Its own newsroom page describes S-18/D.07/2025 as a “Penegasan”, a confirmation of its status, which is an accurate description of a transitional letter rather than a fresh authorisation, and more careful than most marketing on this point.

On the BAPPEBTI side, the register is still live. BAPPEBTI’s Pedagang Fisik Aset Kripto list, read on 12 August 2026, returns sixteen firms as JSON, and the tenth is PT. INDODAX NASIONAL INDONESIA with licence 10/BAPPEBTI/PFAK/12/2024 dated 27 December 2024 and the website www.indodax.com. A register that publishes the licensee’s domain is the strongest identity evidence available for free, because it answers whether this website belongs to the licensed firm rather than whether a name looks similar.

Where the exchange sits in the market structure

Indonesia routes crypto trades through a designated bourse, a clearing house and a depository. Indodax is a member of the first two. None of that is a licence to hold client money, and it should not be read as one.

Both memberships check out at the institutions themselves. CFX’s own member register lists Indodax with SPAB-020/PFAK/CFX/10/2024, marked Certified on the spot market, one of 22 members. Its date field reads 2024-10-10T17:00:00Z, which the page renders as 10 October 2024 while Indodax’s newsroom gives 11 October; the number itself matches exactly. KKI’s members page lists INDODAX, PT Indodax Nasional Indonesia among its clearing members, and names PT Kustodian Koin Indonesia as its depository partner. KKI does not publish membership numbers, so the KKI/SPAK-020/X/2024 reference is Indodax’s own and we record it as its claim. One incidental note for anyone repeating this check: BAPPEBTI’s register gives KKI’s website as www.kliringkomoditi.com, which does not resolve in DNS at all; the live site is www.kliringkomoditi.id. That is a stale field in a government register, not a problem with the clearing house.

The depository row is the one that matters and it is a gap rather than a finding against the firm. OJK licenses a depository for digital financial assets, and Indodax’s user agreement never mentions it, or any custodian. We searched the full 135,571 character Indonesian agreement and its 125,930 character English twin for kustodian, tempat penyimpanan, bursa, kliring, segregasi, rekening terpisah and cold storage. Not one appears, in either language. The agreement is legible and uncompressed, and we ran the project’s evidence readability check over the whole working directory before writing that sentence.

So the custody answer, plainly: your counterparty is PT Indodax Nasional Indonesia, your coins sit in wallets it controls, and your claim on them is contractual. The agreement makes that unusually explicit in one place. Where the same crypto asset cannot be returned because of technical, operational, legal or network constraints, the end of developer support, force majeure or anything else beyond reasonable control, Indodax “may determine an alternative settlement mechanism deemed reasonable”, which “may include, but is not limited to, conversion into another asset of equivalent value, including stablecoins or fiat”. A holder of a specific coin can therefore be paid out in something else at Indodax’s own market reference price.

Certifications on the homepage, and what they actually certify

The Indonesian homepage carries the line “INDODAX berizin dan diawasi oleh Otoritas Jasa Keuangan (OJK) serta terdaftar dan tersertifikasi oleh”, followed by badges for CFX, KKI, the Communications Ministry and two ISO marks. The OJK half of that sentence checks out. The badges are memberships and certifications, not authorisations, and one of them is narrower than it looks.

Both ISO certificates are genuine and current on BSI’s own client directory, which the homepage links directly. IS 830725 is ISO/IEC 27001:2022, effective 27 September 2025 and expiring 26 September 2028. FS 830728 is ISO 9001:2015, effective 25 September 2025 and expiring 24 September 2028. Both are issued to PT Indodax Nasional Indonesia at the Sudirman address. The scope on both, in BSI’s own words, is “the provision of Customer Data Management on Crypto Asset Exchange Services”. An information security certificate scoped to customer data management is not a statement about wallet architecture, key management or the security of the assets themselves, and after coins were drained from the firm’s hot wallets that distinction is worth the reader’s attention.

Trading & Execution

Indodax runs a conventional central limit order book. Buyers and sellers meet on price and quantity, with an IDR side of 493 markets and a USDT side of 13, and the firm’s own newsroom page describes it as “menyediakan sistem order book yang dapat diakses oleh seluruh pengguna”, providing an order book system accessible to all users. There is no leverage, no perpetuals, no futures and no lending, and the help centre confirms in a note updated 6 August 2026 that Indodax offers no USDT loan facility and warns members against any loan offer made in its name on Telegram or WhatsApp. That absence removes an entire category of risk from this review: there are no liquidations here, no margin calls, no forced closure and no negative balance, because there is no borrowed money to call in.

Order entry is split into two front ends on the same book rather than two products. Mode Lite takes a rupiah amount and fills it instantly at the best available price, so a Lite user is always a taker. Mode Pro exposes limit, market and stop limit orders. Indodax states plainly that the fee is identical in both, and that the only difference is whether you cross the spread or wait in the queue. Minimum order size is Rp 10,000 on Lite, and Rp 25,000 to trade directly in Pro; a Pro order between Rp 10,000 and Rp 24,999 is routed through Lite automatically. The pairs API agrees, carrying a minimum of Rp 10,000 on every rupiah market and 1 USDT on every USDT market.

The venue does not appear to trade against its users in the retail order book, and nothing in the agreement or the help centre describes a dealing desk or internalisation. Indodax does run a separate OTC desk for larger orders, where the mechanism is explicitly bilateral: a client agrees a quoted price, transfers funds to an account Indodax provides, and the coins are sent to the client’s wallet address afterwards. That is a principal transaction and it is a different risk shape from the order book, since the client is out of funds before the asset arrives. OTC onboarding for an individual or beneficial owner takes up to three working days once documents are complete.

Trades clear through the Indonesian market structure rather than settling on Indodax’s books alone. Indodax describes itself as a member of both the crypto bourse and the crypto clearing house, applying the CFX levy under BAPPEBTI regulation PERBA 9 of 2024 and joint circulars 003 and 004/SEB/CFX-KKI/X/2024 from 31 October 2024, later revised by circular 001/SEB/CFX-KKI/SPOT/II/2026 from 1 March 2026. What that does not tell you is where the coins sit between trades, which the section above covers.

Fourteen of the 506 markets carried a maintenance flag in the API on 12 August 2026, among them ZIL, INJ, RVN and AVA. None was flagged as suspended. Maintenance on a market is ordinary at any exchange, usually a chain upgrade, but it is worth knowing that the API exposes the flag per pair, which means a reader can check the status of their own coin before they need to move it.

Accounts & Fee Tiers

There is one account. Indodax does not sell account tiers with different spreads, and everything below is a function of verification status and volume rather than a product choice. The interface splits into Lite and Pro modes, the mobile app carries both and the website carries Pro, and the fee is the same in each.

The fee ladder is unusual in that it is published per market in a public API field rather than on a pricing page. Reading indodax.com/api/pairs on 12 August 2026 returns a maker and a taker rate on every one of the 506 entries, and they resolve into exactly two tiers.

That is the Indodax service fee alone. The number a member actually pays is what Indodax calls the All in Fee, and it has three parts: the service fee above, Indonesian tax, and the CFX levy owed to the bourse and clearing house. Working it through for a rupiah market at current rates, a taker buying pays 0.20% plus 0.0111% and no tax, because Finance Ministry regulation PMK 50 of 2025 removed VAT from crypto purchases from 1 August 2025. A taker selling pays 0.20% plus 0.0111% plus 0.21% income tax, which is roughly twice the cost of the buy. A maker buying pays about 0.1111%, and a maker selling about 0.3211%. Nobody publishes that comparison, and it is the single most useful cost fact on this platform: on Indodax, selling is the expensive side.

The CFX component fell on 1 March 2026, from 0.0222% to 0.0111% on rupiah markets and from 0.0444% to 0.0222% on USDT markets, following joint circular 001/SEB/CFX-KKI/SPOT/II/2026. Indodax announced it on its own blog on 27 February 2026 and set out how limit orders placed before the change but filled after it keep the old rate, which is the correct and honest way to handle a fee cut.

Volume based discounts are the one part of the ladder we could not pin down. Indodax’s help centre refers to Konsumen Regular, Konsumen Prioritas and Konsumen Priority Prime as consumer categories, and its chatroom colours members by lifetime transaction value in bands running from Newcomer, meaning no transactions at all, and New Trader below Rp 10,000,000, up to above Rp 25,000,000,000, but neither is presented as a fee schedule and we found no published table linking a volume band to a rate. The firm directs members to Profile then Settings then Trading Fees in the app or website to see their own All in Fee, which is behind a login. We have not opened an account, so we record that as unverified rather than absent.

One thing did break while we looked. The fee schedule article links an explainer titled “Apa itu Market Taker, Market Maker dan Stop Order” for the detail behind maker and taker pricing. That article is not among the 1,473 Indonesian or 1,478 English articles the help centre’s public API returns, and fetching its published URL through an in country proxy returns a Zendesk sign in page rather than content. We fetched the fee article itself the same way, in the same run, and it returned its full text and tables, so this is a difference in the resource rather than in our fetcher.

Proof of Reserves

Indodax makes a proof of reserves claim in two places, and they rest on two very different kinds of evidence. Separating them is the whole of this section.

The accountant’s letter, measured at 31 January 2023. The help centre article “Apakah Indodax memiliki Proof of Reserve (PoR)?”, updated 7 July 2026, says the proof of reserves is backed by an audit from the public accounting firm Kreston Indonesia KAP Hendrawinata Hanny Erwin & Sumargo, which verified an agreed upon procedures engagement on proof of reserves and liquidity adequacy as at 31 January 2023 and issued its report on 18 April 2023. We fetched the document that article links, exactly as it links it. It is a two page cover letter, reference 486/GN/LJ/HHES/IV/23, dated 18 April 2023 and signed by Zulbadri CPA as partner. It reports no exceptions, and states that the company’s cash and payment gateway receivables exceeded total member liabilities on that date, and that its crypto asset balance exceeded total member portfolios on the same date. That covers liabilities as well as assets, which is the right shape and better than many attestations.

Its limits are limits of evidence rather than accusations. It photographs a single day, and that day is now three and a half years past. It predates the September 2024 theft, so it says nothing about the position after the event most likely to affect it. And what is published is the covering letter, not the report: the letter itself says the AUP report was issued separately, and an agreed upon procedures engagement is not an audit opinion in any case, because the accountant performs procedures the client agreed and reports findings without opining on the whole.

The current claim, which is a listing rather than an audit. On 6 January 2026 Indodax posted a proof of reserves update on its own blog announcing “implementasi dan pembaruan rutin Proof of Reserves”, routine implementation and updating, and describing itself as the only local Indonesian crypto exchange publishing its PoR on CoinMarketCap, with a last published asset total “di atas 18T”, above 18 trillion rupiah. The post concludes that member balances and crypto assets are “100% aman karena didukung oleh cadangan yang terverifikasi dan telah diaudit”, 100% safe because they are backed by verified and audited reserves.

We do not treat market data aggregators as evidence, so we take no figure from that listing, and we note two things about it that a reader can check for themselves. The exchange page in question invites operators to “Submit Reserve Data”, so the reserve figures there originate with the exchange. And the descriptive text on that page, the paragraph a reader would take for an independent profile, is Indodax’s own copy: it is carried in the page’s own data as the exchange supplied description. Anyone verifying Indodax’s claims there is reading Indodax’s words back to themselves.

That matters because of what a wallet listing can and cannot show. On chain reserves demonstrate assets. Solvency is assets against liabilities, and nothing published on chain reveals what an exchange owes its members. The 2023 letter did address both sides. The 2026 claim, on the evidence published, addresses one.

There is no Merkle tree, no member level verification tool and no recurring attestation by an accountant. We searched both language versions of the help centre, 1,473 Indonesian and 1,478 English articles, for merkle, cadangan, custodian and cold storage; the only Merkle articles are general education about what a Merkle tree is. There is no insurance fund either. The English user agreement mentions insurance only to say that crypto assets “are not guaranteed or insured by any central authority” and that “no central bank, deposit insurance agency, or financial regulator can provide protection if there is a loss in value”.

Because this section carries proof of reserves for a crypto review, the liquidation and margin mechanics that would normally live here are dealt with in Trading and Execution above. The short version is that they do not exist: Indodax is spot only, with no borrowing, so there is nothing to liquidate and no negative balance to protect against.

Listed Assets

On 12 August 2026 the public pairs API returned 506 tradable markets covering 497 distinct coins. The split is lopsided by design: 493 markets quote in rupiah and only 13 in USDT, those being BTC, ETH, SHIB, PEPE, BONK, FLOKI, LUNC, BTT, XEC, PUNDIX, IDRX, VCG and VOLT. The homepage advertises “500+ Koin” and the newsroom page says more than 500 crypto assets, while a second paragraph on the same newsroom page says more than 490. The API settles it, and it settles it narrowly: there are 506 markets, so the figure clears 500 if a coin means a market, but only 497 distinct coins, so it does not if a coin means a coin.

Breadth this wide on a national exchange is a double edged thing. It means a Jakarta retail buyer can reach almost anything without leaving the rupiah system, and it means a large share of the list is thinly traded microcap. The market page groups listings into categories including IDR Markets, USDT Markets, New Coin, Meme, DeFi, NFT and Gaming, Metaverse, Layer 1 and 2, Stablecoin, RWA, AI and Big Data, Blockchain Service, CEX and DEX, Innovation and Tokenized Stock.

Listing and delisting are decided by Indodax, with no published committee, no scoring framework and no appeal. The help centre article on delisting, updated 12 August 2026, says a coin is removed after in depth evaluation weighing security, trading volume classified as very low, the existence of legal cases, and “the policy and considerations of management”. It adds that delisting sometimes comes at the developer’s own request, for example when a project is discontinued, but that the more common cause is an asset no longer meeting exchange requirements. Members holding a delisted coin are told to withdraw it to another wallet or platform.

The agreement puts a hard clock on that. A delisted asset carries a settlement period of thirty days from the effective date, during which the member remains responsible for managing and withdrawing it. After that period Indodax may transfer the assets to a custody wallet it designates, or convert them into another asset of equivalent value. A member who is not paying attention for a month can therefore find a holding converted rather than returned. The firm does maintain an alarm feature and publishes delisting notices in advance, and it has repeatedly published delisting postponements, so the process is at least visible.

Fourteen markets carried a maintenance flag in the API when we read it, and none was suspended. Deposits were disabled on none of the 506. Sixteen assets require a memo or destination tag on withdrawal, which is the ordinary source of lost transfers on chains like XRP and XLM, and Indodax publishes a help article on how to handle that field.

Research & Tools

Indodax puts most of its educational weight behind Indodax Academy, a separate section of the site, and a help centre that is genuinely large. The Zendesk guest API returns 1,473 published articles in Indonesian and 1,478 in English, and the overlap is near total: exactly one article exists only in Indonesian and six only in English, all six of them legacy items about faucet sites, advertising enquiries and a 2022 trading event. For a reader who does not speak Indonesian, that parity matters more than it sounds, because it means the English documentation is not a thin marketing subset of the real thing.

The written material is heavily weighted to explanation rather than analysis. Sampling the 1,473 Indonesian articles, there are pieces on what a Merkle tree is, what an automated market maker does, what a spread is, what proof of stake means, what cold storage is, what an MPC wallet is, and how a hardware wallet differs from a hot wallet. What there is not, anywhere we looked, is proprietary market research, published order flow statistics, an in house analyst desk, or trade ideas. That is a defensible choice for a licensed venue in a market where investment advice is a regulated activity, and it is consistent with the firm’s own disclaimer that its material is not an offer, recommendation, solicitation or advice.

Charting is provided in the Pro interface. The market page exposes per pair depth charts and price charts, and the site’s 709 byte sitemap index publishes four separate sitemaps, for homepage, market, depth_chart and chart, which is a reasonable proxy for how much of the product is chart driven. Beyond that we could not confirm the indicator set without an account, and we have not opened one, so we record it as unchecked rather than absent.

The public data layer is the strongest research tool here and it is free and unauthenticated. indodax.com/api/pairs returns the full instrument list with per pair precision, minimum order size, maintenance state and both fee rates. indodax.com/api/summaries returns 506 tickers with 24 hour and seven day price history. Both answered a plain request from outside Indonesia with no key, no cookie and no proxy, in a few hundred milliseconds. A private trader can build a cost model and a screener off those two endpoints alone.

The Trade API documentation is a different matter, and the reason we could not read it is a fact about the product rather than about us. Requesting indodax.com/trade_api/ with a browser user agent on 12 August 2026 returns HTTP 302 to /trading_risk_agreement, and following that chain ends at /login. The documentation is gated behind a trading risk agreement and an account, so a prospective user cannot read the API terms, the rate limits or the endpoint list before signing up. That is a defensible choice for a venue that wants a risk disclosure acknowledged first, and it is worth knowing before planning an integration. We have not opened an account, so we describe none of the contents. Note also that Indodax’s robots.txt disallows /api as well as /trade_api, so the crawl policy does not distinguish the documentation from the market data endpoints that answer freely.

Earn, Staking & Lending

The most consequential thing in this section is what Indodax does not do. It runs no lending product. A help centre article updated 6 August 2026 answers the question directly, says there is no USDT loan facility, lists the actual features as trading, deposit and withdrawal, staking, Quick Buy USDT and scheduled investing, and warns members to be alert to any offer of a loan, capital advance or one sided investment made in Indodax’s name on social media or in Telegram and WhatsApp groups. A licensed exchange telling its own users that loan offers in its name are fraudulent is worth more to a reader than any promotion on the page.

Staking is the one yield product, and on 12 August 2026 it was closed. The status page showed Staking as “Dalam Pemeliharaan”, under maintenance, and a help article updated 9 August 2026 explains that when every coin shows an Oversubscribed status simultaneously it means the staking infrastructure is under maintenance and the system is suspending new deposits. Existing stakes, the firm says, remain safe and continue to accrue rewards. No end date is given.

When it is open, the mechanics are set out in a dedicated set of terms. The supported assets are DOT, POL, BNB, SOL, ETH, ADA and TRON. Subscribing means agreeing to stake through the Indodax system, to name Indodax as validator on the relevant network, and to delegate any voting rights attached to the staked assets to Indodax. Assets pass through a bonding queue before earning, with the daily transition at 14:00 WIB, and through an unbonding queue on the way out, with that transition at 12:00 WIB. Rewards are paid net of staking fees and any slashing penalty, and the terms state that consent to them is irrevocable.

One clause in those terms sits oddly against how the exchange works, and it is worth quoting because a reader could take it the wrong way. The staking terms say, in English, that “INDODAX will not hold your private keys or act as a custodian of your funds”. That is a natural sentence in a non custodial staking product. It is not a description of Indodax, which holds member coins in wallets it controls, which is precisely why a failure in its own systems was able to cost it money in 2024. We are quoting the firm’s own document; we are not asserting it describes the arrangement, and the general user agreement does not repeat the claim.

Quick Buy USDT, an instant purchase route, was also under maintenance on 12 August 2026, and a help article updated 7 August 2026 says the duration cannot be confirmed because the feature is under technical review. Scheduled investing, branded Investasi Rutin or DCA, was operating. There is also a points and rewards programme, DAX Points and DAX Rewards, open to individual accounts that have completed KYC, earned through daily check ins, trading, deposits, staking, watching Academy videos, following social accounts and referrals. Indodax states that the activities and point values can be changed at any time at its own discretion. A referral programme pays 10% of the maker and taker fees generated by an invited member, and that member’s active period lasts 90 days from verification and first IDR market trade.

Opening an Account

Registration is open to individuals and to institutions, and the account only becomes useful once identity verification is complete. Indodax draws the line explicitly: a Konsumen Terverifikasi is a consumer who has completed the full registration and KYC process and therefore has full access to buying, selling, depositing and withdrawing crypto. An unverified account cannot even apply to raise its withdrawal limit.

Verification runs automatically where the data is clean, and the firm’s own estimate, in an article updated 4 August 2026, is roughly 24 hours. A rejection arrives by email with the reason, and the applicant resubmits. Identity evidence is a national ID card or a passport, with the help centre listing what else may be attached where those are unavailable, plus a selfie. Face detection is used again later as a security step: attempting to raise a withdrawal limit can trigger an “Aktivitas Akun Anda Terkunci” notice, which is cleared by a live face scan.

Two requirements shape who can realistically use this exchange from outside Indonesia. Everyone must supply a country of domicile and a tax identification number for that country, which Indodax says it uses to align its tax reporting and compliance, warning that an incorrect domicile can misfile a member’s tax position. And a foreign national applying to raise transaction limits must additionally upload a valid KITAS or KITAP, the Indonesian limited stay and permanent stay permits, as part of customer due diligence. A foreign national living abroad can therefore hold an account but has no documented route to lifting the default limits.

Nationality is a hard gate before any of that. Indodax states in both languages that citizens of the United States, Myanmar, Côte d’Ivoire, Cuba, Iran, Syria, Belarus, Congo, the Democratic Republic of Congo, Iraq, Liberia, Sudan, Zimbabwe and North Korea are not permitted to open an account.

Security options at account level are better than the regional norm. The platform supports passkeys, biometrics, a Google Authenticator style code, and verification codes by email, SMS or WhatsApp, and a member can choose which channel carries the security code. Withdrawal by SMS OTP costs Rp 1,000 more than the alternatives, which is a small but real nudge away from the weakest factor. There is also a documented inheritance process: a legal heir can claim a deceased member’s assets either online or by visiting an Indodax office, which is a piece of operational maturity most exchanges never write down.

Deposits & Withdrawals

Rupiah is the only fiat currency. Indodax confirmed in an article updated 7 August 2026 that it does not offer USD withdrawals and uses rupiah as its official fiat currency for both deposits and withdrawals, so that funds land directly in the Indonesian banking system. Anyone outside Indonesia is dealing with a rupiah venue whether they wanted one or not.

The deposit menu is domestic and the pricing is published in full.

Rupiah withdrawal goes to a registered bank account in the member’s own name, costs a flat Rp 10,000 plus Rp 1,000 if the confirmation is by SMS OTP, and runs from Rp 100,000 to Rp 5,000,000,000 per transaction subject to the account’s daily limit. Crypto deposits are free. Crypto withdrawal fees vary by asset and network, and this is the one significant gap in the published pricing: rather than a table, the help centre tells members to open the withdrawal screen in the app or website and read the fee there. That figure is behind a login, so we have not verified any specific coin’s withdrawal cost and do not quote one.

Daily withdrawal limits are per account and are raised on application, with KYC as a precondition and, for foreign nationals, a residence permit. Indodax publishes no table mapping verification level to limit, which means a member cannot work out in advance what they will be allowed to move.

Incident record

This is the most predictive material on the page, so it is set out by date, and each entry is labelled by what kind of claim it is: alleged, said by Indodax, independently established, or actually made good. Amounts are given as each source gave them, because the sources do not agree and Indodax has never reconciled them in public.

Four things stand out from that record, and they are all about evidence rather than about how bad the theft was.

The repayment has never been independently verified, and that gap has now been tested in court. Indodax says it replaced the loss from its own reserves and that no member was worse off. Nothing we could find corroborates it: no post incident audit, no accountant’s sign off on the replacement, no regulator statement to that effect. The only third party attestation of reserves in existence is the letter measured at 31 January 2023, twenty months before the loss. And when defence counsel asked an Indodax witness in open court on 6 July 2026 whether an audit underpinned the Rp 300 billion figure, the witness said he knew which assets had gone missing but could not confirm one. That is not a finding that no audit exists, and the surrounding assertions are a defendant’s. But the one occasion on which somebody with subpoena power put the question to the company, the company’s own witness could not point to an audit either.

The word hack never appeared on Indodax’s own channels. Its incident statement described “potensi indikasi keamanan”, a potential security indication; its maintenance notice said pemeliharaan; its public holding page said the site was undergoing a pembaruan sistem, a system update, to improve transaction convenience. Its then chief executive did use the word peretasan the same day, but in BAPPEBTI’s press release rather than to Indodax’s own customers. A member checking the site or the blog on 11 September 2024 would not have learned from either that anything had been stolen.

Both incident window posts have been deleted. The maintenance notice of 10 September and the incident statement of 11 September 2024 now return 404 on Indodax’s own blog and are absent from that blog’s own API. They survive only in the Internet Archive. A firm is entitled to tidy its blog; a reader trying to check what an exchange said during its worst week should know the primary record is no longer where it was published.

The figures were never reconciled. $18.2m from Cyvers, about $22m from SlowMist, about $20m or Rp 300 billion from Indodax. Indodax has not addressed the gap publicly, and no forensic report was ever published. The six security firms it says it engaged, and the firm that attributed the attack to North Korea, are unnamed to this day.

For balance, two things the record does not show. We found no BAPPEBTI or OJK sanction, fine, suspension or licence action against Indodax at any date, and we looked. And we found no hack, theft or insolvency in the bitcoin.co.id years from 2014 to 2018.

Service status when we looked

Indodax runs a public status page at blog.indodax.com/status. Read on 12 August 2026, it listed Staking and Quick Buy USDT as under maintenance and every other transactional feature, including rupiah and coin deposits and withdrawals, without an issue flag. Every row on the page carried a last updated stamp of 10 or 11 July 2026, so the page had not been touched in about a month at the time of reading. A status page is only as good as its update discipline, and this one publishes no incident history at all, which is why the record above had to be assembled from regulators, security firms, the Indonesian press and the Internet Archive rather than from the exchange.

Customer Support

Support is one of the stronger parts of this platform, and unusually for the region it is reachable by more than a form. Indodax publishes a Jakarta phone number, (021) 5065-8888, an email address, [email protected], and a live chat that runs in both the website and the mobile app. Its own help centre, in an article updated 6 August 2026, describes the customer support team as ready to help 24/7 through live chat in the app or by email.

Live chat opens with a bot that suggests help articles, and a “Get in touch” option escalates to a human agent. The bot follows the language setting of the member’s device rather than the site, which is a small design decision worth knowing if you are reading in English on an Indonesian phone. Chat transcripts can be retrieved afterwards, and a report started in a chat session that has since ended can be continued.

Behind the live channels sits a large self service estate: 1,473 Indonesian and 1,478 English articles, actively maintained rather than archived. Sampling the corpus on 12 August 2026, a large share of articles carried an update stamp within the previous six weeks, and several within the previous 24 hours. The writing is specific rather than generic, answering things like why a daily withdrawal limit has dropped to 16 IDR, whether a pending withdrawal can be cancelled during a network maintenance, and whether a delisting postponement means the delisting will not happen.

Three offices are published with full addresses, two in Jakarta at Sudirman and Pondok Indah and one in Bali at Legian, and the inheritance claim process explicitly allows an heir to walk into one. Physical presence is a real support channel in a market where it matters, and very few crypto exchanges offer it anywhere.

Against that, incident response is where the evidence is thinnest. The status page carries no history, so a member cannot look up what happened last time, how long it lasted or what was said. Two features were sitting under maintenance with no completion estimate when we looked, and the help centre’s answer on the duration of the Quick Buy USDT maintenance is that it cannot be confirmed because the matter is under technical review. Support that is easy to reach is not the same as an operator that tells you what is going on, and Indodax is clearly better at the first than the second.

One documentation failure is worth flagging because it touches pricing. The fee schedule article links an explainer on market maker, market taker and stop orders; that article is absent from the public help centre index in both languages, and its published URL returns a sign in page. The fee information itself is recoverable from the public API, but a member following the firm’s own link finds a login screen instead of an explanation.

Restricted Countries

Indodax publishes a nationality restriction and it says the same thing in both languages, which is not something we can take for granted. The Indonesian article, updated 8 July 2026, reads: “Semua warga negara bisa menjadi member Indodax. Kecuali warga negara Amerika Serikat, Myanmar, Cote D`Ivoire, Cuba, Iran, Syrian Arab Republic, Belarus, Congo, Democratic Republic of Congo, Iraq, Liberia, Sudan, Zimbabwe, dan Korea (north).” The English article carries the identical list, saying citizens of those states “are not allowed to open an account in Indodax.com”.

So the excluded nationalities are: the United States, Myanmar, Côte d’Ivoire, Cuba, Iran, Syria, Belarus, Congo, the Democratic Republic of Congo, Iraq, Liberia, Sudan, Zimbabwe and North Korea. The list reads as a sanctions and financial action screen rather than a licensing one, and the inclusion of the United States alongside them is the familiar decision of a venue that does not wish to deal with US regulatory exposure.

Beyond that list, Indodax states that all nationalities may become members. That is a genuinely open position by the standards of licensed exchanges, but it should not be read as an invitation. Three practical constraints narrow it hard, and each is documented by the firm rather than inferred by us:

• Rupiah is the only fiat rail, with no USD deposits or withdrawals, and rupiah withdrawal goes to a local bank account in the member’s own name.
• Every member must declare a country of domicile and a tax identification number for it, uploading the tax document, as part of verification.
• A foreign national must supply a KITAS or KITAP, the Indonesian stay permits, to raise transaction limits, which leaves a non resident foreign national with no documented route past the defaults.

We found no statement from Indodax excluding any country on residence rather than nationality, and no regulator prohibition against it that we could reach. We are not treating any other list as a restriction, and the phone number country list Indodax adjusted in an article of 4 August 2026 concerns which dialling codes are supported for account security messages, which is a different thing and we are not presenting it as a country ban.

Conclusion

Indodax is a real, licensed, twelve year old exchange, and the oldest in Indonesia. Its OJK permission is not a claim we took from its marketing: we found S-18/D.07/2025 on OJK’s own register at position 25 May 2026 and in OJK’s own whitelist press release, and its earlier BAPPEBTI licence is still published with its domain attached. Its membership of the licensed bourse and clearing house is confirmed at both institutions. OJK’s own May 2026 register lists 26 licensed digital financial asset traders, so an Indonesian resident is not short of supervised options, and Indodax is the oldest and by its own account the largest of them.

The problem is not the licence. It is that the licence does not do what a reader assumes it does. Nothing in the Indonesian framework insures a balance. Indodax holds the coins itself: no third party custodian is named anywhere in a 135,571 character user agreement, no segregation clause exists in either language, and there is a clause allowing settlement in a different asset entirely if the original cannot be returned. Your position is a contractual claim on one Jakarta company.

In September 2024 that arrangement was tested. Somewhere between $18.2m and $22m left its hot wallets, on the firm’s own later account because an engineer took an outside freelance job and ran a malware laced file on a company laptop. The one security firm that named a mechanism, SlowMist, ruled out a compromise of the hot wallet keys and pointed at the withdrawal system, so the wallets are where the coins were, not necessarily where the failure was. Indodax says it replaced the loss from its own reserves and that no member was worse off, and it has been consistent about that for two years. We could not find a single independent source that confirms it, and the only accountant verified reserve statement in existence was measured twenty months before the theft. That is the central fact of this review: the most consequential claim about this exchange is a claim, and the firm has published nothing that would settle it.

What follows from that is a pattern in how the firm talks to its own customers when things go wrong, and it is fair to be specific rather than vague. On the day, its blog statement described “potensi indikasi keamanan”, a potential security indication, and its public holding page said the site was undergoing a system update to improve transaction convenience. Its chief executive did confirm the alleged hack that same day, plainly, in BAPPEBTI’s press release. So the candour existed; it just was not on the channels a member would check. Both of those blog posts have since been deleted and survive only in the Internet Archive. In December 2025, facing reports of missing balances, the firm’s public position was that the cause was unauthorised access on the member’s side through malware and phishing, and OJK confirmed in early January 2026 that it had summoned Indodax management because there were still two versions of events. A separate dispute over a delisted token is reported to have failed mediation and gone to OJK examination, though that account comes from the token side rather than from OJK. We found no sanction of any kind from either regulator. It is an open file, and a reader is entitled to know it is open.

Against that sits a genuinely competent exchange. Fees are published per pair in a public API that anyone can read without an account, at 0.10% and 0.20% on rupiah markets and 0.03% and 0.06% on USDT, with the exchange levy cut in March 2026. Deposits are cheap or free, rupiah withdrawal is a flat Rp 10,000, and there is no leverage to lose money with. Support is reachable 24/7 by chat, by email, by phone and in person at three offices, behind a help centre of nearly 1,500 articles maintained in Indonesian and English at genuine parity. The firm tells its own members that anyone offering loans in its name is defrauding them. These are not the habits of an operation that does not care.

Who it suits: an Indonesian resident who wants a rupiah on ramp at a supervised venue, who trades spot, and who understands that the exchange is the custodian and there is no compensation scheme behind it. Who should look elsewhere: anyone outside Indonesia, because there is no USD rail and a foreign national abroad cannot lift the default limits; anyone who wants leverage or derivatives, which do not exist here; and anyone whose comfort depends on a current, independent proof of reserves covering both sides of the balance sheet, because that does not exist here either. The general point holds here as at any exchange: a balance on the platform is a claim on the platform, and coins held in a wallet whose keys you control are not.

FAQ