Indodax lost roughly $25.22 million on September 10 after attackers initiated withdrawals across Ethereum, Polygon, Tron, Bitcoin, and other chains. Cyvers reported suspicious transactions from exchange wallets, while SlowMist assessed that the activity did not look like a simple hot-wallet compromise and may have involved the withdrawal system. Cyvers noted that the speed, complexity, and transaction pattern resembled Lazarus Group activity, but the source explicitly says attribution was premature. The report lists compromised exchange wallets and follow-on addresses used to move stolen funds, making the incident relevant for tracking possible DPRK-linked cryptocurrency theft tactics without treating the attribution as confirmed.