Table of Contents
Thailand's Securities and Exchange Commission filed a criminal complaint against crypto exchange Bitkub Online and two of its former directors on July 23, alleging the company submitted false statements to the regulator following a 2021 hack, according to reporting from The Nation Thailand.
The complaint centers on a May 2021 cyberattack in which 16 types of digital assets were stolen from Bitkub, worth an estimated 1.7 billion baht, roughly $48 million. The SEC said Bitkub's daily net capital reports, known as Form DA 1, filed between May 10 and October 30, 2021, showed no significant change in the company's assets despite the theft, which the regulator characterized as the submission of false statements. The SEC said it found Bitkub had begun procuring replacement digital assets starting October 31, 2021, months after the attack.
The complaint names Bitkub Online, along with former directors Sakolkorn Sakavee and Thaweesap Rawan, who the SEC said were responsible for filing Form DA 1 during the period in question. Bitkub and the two individuals face charges under Sections 76 and 94 of Thailand's Digital Asset Business Decree, while Sakavee and Rawan individually face an additional charge under Section 88 for allegedly making false entries in company documents to mislead the regulator. The case now moves to Thailand's Economic Crime Suppression Division for police investigation, followed by a prosecutorial decision on indictment and, potentially, trial.
Bitkub responded the same day with a public statement defending the nondisclosure as a deliberate choice rather than a cover-up. The company said it withheld news of the theft at the time specifically to prevent a bank run, in which customers, on learning of the hack, might have rushed to withdraw assets simultaneously before Bitkub could source replacements. Bitkub said its group co-founders personally purchased replacement digital assets in the same currencies and quantities as those stolen, so that neither the company nor its customers ultimately suffered losses, and that all customer assets today remain fully intact.
The company pointed to a range of security credentials, including ISO 27001 and ISO 27701 certification, a SOC 2 Type I report, a top-20 ranking from cybersecurity rating site Cer.Live, and custody arrangements with BitGo Trust and Coinbase Custody, and said the SEC had separately confirmed as of September 2025 that customer assets on the platform were safe and complete. Bitkub also warned the public against publishing information it said could create a misleading impression of its financial position, adding that it may pursue legal action in response.
The dispute turns less on whether customers were ultimately made whole, which both the SEC's complaint and Bitkub's statement suggest they were, and more on whether Bitkub was entitled to make that call unilaterally rather than disclosing the theft to its regulator at the time it happened.
