Thailand’s Securities and Exchange Commission (SEC) has filed a criminal complaint against cryptocurrency exchange Bitkub Online Co., Ltd. and two of its former directors over alleged false regulatory disclosures following a cyberattack in 2021.
The regulator claims Bitkub failed to accurately report the impact of the security breach on its digital asset holdings in regulatory filings submitted between May and October 2021. Bitkub has rejected the allegations, maintaining that the case concerns historical disclosure decisions rather than the safety of customer funds, which it says have remained fully protected.
Key Takeaways
- Thailand’s SEC has filed a criminal complaint against Bitkub and two former directors over alleged false disclosures following a 2021 cyberattack.
- The regulator alleges Bitkub’s daily net capital reports failed to reflect the reduction in digital assets caused by the breach.
- Bitkub says the delayed disclosure was intended to prevent a mass withdrawal of customer assets while stolen funds were being replaced.
- The exchange maintains that customer assets remain fully protected and no customers suffered financial losses.
- The complaint has been referred to Thailand’s Economic Crime Suppression Division for further investigation.
SEC Alleges Inaccurate Reporting After 2021 Cyberattack
The complaint, filed on July 23, 2026, targets Bitkub Online and former directors Sakolkorn Sakavee and Thaweesap Rawan.
According to the SEC, the exchange’s daily net capital reports submitted between May 10 and October 30, 2021, failed to accurately disclose the material reduction in digital assets following a cyberattack that compromised one of the company’s wallets. The regulator alleges the reports created the impression that customer assets remained unaffected and that the company had not suffered losses from the incident.
The SEC further accused the two former directors of making false entries in company documents related to the exchange’s financial position during the reporting period. The matter has now been referred to Thailand’s Economic Crime Suppression Division, where investigators will determine whether sufficient evidence exists to proceed with prosecution. The regulator emphasized that filing a criminal complaint does not constitute a finding of guilt.
Bitkub Says Disclosure Delay Protected Customers
Bitkub responded by stating that the complaint relates to decisions made during the aftermath of the 2021 cyberattack rather than fraudulent conduct.
According to the exchange, an individual responsible for disclosure obligations intentionally delayed announcing the wallet compromise to avoid triggering a large scale withdrawal of customer assets while the company worked to replace the stolen cryptocurrencies.
The company argued that immediate disclosure could have resulted in a “bank run,” making it difficult to secure replacement digital assets before customers withdrew their balances.
“The decision of such individual not to disclose the incident was made with the intention to prevent a bank run—that is, a mass withdrawal of digital assets by customers upon learning of the theft, which could have rendered the Company unable to procure sufficient replacement digital assets for the customers while the recovery process was still ongoing.”
Bitkub added that such an outcome could have caused greater losses for customers and undermined confidence in Thailand’s digital asset industry.
Co Founders Replaced Stolen Assets
Although the cryptocurrencies stolen during the cyberattack were never recovered, Bitkub said its co founders personally absorbed the financial loss.
According to the company, they purchased digital assets matching the same types and quantities as those stolen and transferred them to Bitkub, restoring customer holdings without imposing losses on users.
“As no bank run occurred, even though the stolen digital assets could not be recovered, the Co-Founders of the Bitkub Group voluntarily absorbed the loss by purchasing equivalent digital assets (in the same type and quantity as those stolen) and providing them to the Company. Consequently, neither the Company nor its customers suffered any financial loss from the theft.”
The exchange also stated that its wallet security systems complied with regulatory standards at the time of the incident and had undergone independent audits.
Exchange Says Customer Assets Remain Secure
Bitkub emphasized that the current investigation concerns reporting practices from more than five years ago and does not reflect the present condition of customer assets. The company noted that a previous inspection by the Thailand SEC confirmed that all customer assets held by the exchange were safe and fully accounted for as of September 8, 2025.
Reaffirming its position, Bitkub stated that customer funds currently held on the platform remain fully protected in accordance with applicable regulations and that it continues to comply with legal requirements governing digital asset custody.
Investigation Moves to Next Stage
The criminal complaint begins the formal investigative process but does not determine legal liability. Investigators from Thailand’s Economic Crime Suppression Division will examine the allegations before deciding whether the case should proceed to prosecutors and, ultimately, the courts.
The outcome will determine whether Bitkub’s reporting following the 2021 cyberattack complied with Thailand’s digital asset regulations and disclosure requirements.
Conclusion
The criminal complaint against Bitkub centers on whether the exchange accurately reported the financial impact of a 2021 cyberattack rather than on the security of customer assets. While Thailand’s SEC alleges the company submitted misleading regulatory reports, Bitkub maintains that its actions were intended to protect customers during the recovery process and that all losses were fully covered by its co founders.
As the investigation progresses, the case is expected to clarify the disclosure obligations of digital asset exchanges following cybersecurity incidents and could influence future regulatory expectations across Thailand’s cryptocurrency sector.
