SEC Allegations and Reporting Breaches
Thailand’s Securities and Exchange Commission has filed a criminal complaint against Bitkub Online Co. Ltd. and two former directors for allegedly submitting false financial reports following a 2021 cyberattack that resulted in the theft of over $50 million (1.7 billion baht) in digital assets.
The complaint, lodged with Thailand’s Economic Crime Suppression Division (ECD), names the cryptocurrency exchange alongside former company directors Sakolkorn Sakavee and Thaweesap Rawan.
According to the SEC, Bitkub suffered a cyberattack in May 2021 that breached 16 types of digital assets. Regulator investigations revealed that from May 10 to Oct. 30, 2021, the exchange failed to reflect the loss in its daily net capital reports, known as Form DA 1. The SEC alleges the executives intentionally made false entries in official company documents to mislead regulators into believing customer assets were intact and that the firm had suffered no financial damage.
The regulator noted that while Bitkub eventually procured replacement assets by late October 2021, the interim reporting constituted false statements under the Emergency Decree on Digital Asset Businesses B.E. 2561 (2018). A few months before the attack, Bitkub also suffered an outage that prompted the SEC to ask the exchange to temporarily halt operations.
The criminal complaint hands the case over to local police for further investigation, after which prosecutors will determine whether to formally indict the company and the two former directors.
However, in a statement released July 23, Bitkub defended its actions, assuring clients that all current customer holdings remain safe and fully accounted for. The exchange confirmed that leadership chose not to publicly disclose the cyberattack in May 2021 specifically to avert a run on the exchange, which could have destabilized the broader domestic crypto market.
Bitkub, which reportedly explored a Hong Kong IPO in late 2025, said its co-founders absorbed the loss by buying replacement assets in identical amounts and currencies, guaranteeing that customer funds remained intact.
The exchange added that it reported the cyber theft to law enforcement authorities on May 10, 2021, and continues to pursue legal remedies against the perpetrators. It emphasized that its operations, security standards, and governance have since been significantly upgraded under independent board oversight.
