Jakarta. Indonesian police have arrested a local hacker accused of exploiting a security flaw to siphon off millions of rupiah worth of cryptocurrency from a London-based trading firm. Investigators say the scheme targeted Finalto International Limited, the owner of global trading platform Markets.com, causing losses of around Rp 6.67 billion ($398,000).

The Cybercrime Directorate of the National Police uncovered the operation after Finalto filed a report alleging suspicious manipulation of crypto purchase transactions by certain users on its platform.

Deputy Cybercrime Director Andri Sudarmadi said investigators traced the issue to an anomaly in Markets.com’s system, where the input field for deposit amounts could be exploited. The platform automatically generated USDT balances based on whatever nominal figure the attacker entered, creating an opening for fraudulent gains.

According to police, the suspect, identified as HS, created four fake user accounts under the names Hendra, Eko Saldi, Arif Prayoga, and Tosin. He allegedly sourced real identity data by scraping Indonesian national ID information (e-KTP) from publicly accessible websites.

HS, an Indonesian citizen and longtime cryptocurrency trader, was arrested on Nov. 15 in Bandung, West Java. Police say his experience in crypto trading since 2017 helped him identify and exploit the system vulnerability.

Authorities seized significant evidence, including a laptop, a mobile phone, a CPU unit, an ATM card, and a cold wallet containing 266,801 USDT, worth approximately Rp 4.45 billion.

HS now faces charges under Indonesia’s cybercrime and anti–money laundering laws. If convicted, he could receive up to 15 years in prison and fines reaching Rp 15 billion.