Thailand's Securities and Exchange Commission filed a criminal complaint against Bitkub Online Co. Ltd. and two former directors, Sakolkorn Sakavee and Thaweesap Rawan, alleging the cryptocurrency exchange submitted false financial reports following a May 2021 cyberattack that resulted in the theft of over $50 million (1.7 billion baht) in digital assets. The SEC alleges the executives intentionally made false entries in daily net capital reports (Form DA 1) from May 10 to Oct. 30, 2021, to mislead regulators into believing customer assets were intact and the firm had suffered no financial damage. The complaint, lodged with Thailand's Economic Crime Suppression Division (ECD), stems from the exchange's alleged failure to reflect the loss during the interim period before replacement assets were procured by late October 2021, constituting violations under the Emergency Decree on Digital Asset Businesses B.E. 2561 (2018).
SEC Alleges False Reporting Following May 2021 Cyberattack
According to the SEC, Bitkub suffered a cyberattack in May 2021 that breached 16 types of digital assets. Regulator investigations revealed that from May 10 to Oct. 30, 2021, the exchange failed to reflect the loss in its daily net capital reports, known as Form DA 1. The SEC noted that while Bitkub eventually procured replacement assets by late October 2021, the interim reporting constituted false statements under the Emergency Decree on Digital Asset Businesses B.E. 2561 (2018).
The criminal complaint hands the case over to local police for further investigation, after which prosecutors will determine whether to formally indict the company and the two former directors. A few months before the attack, Bitkub also suffered an outage that prompted the SEC to ask the exchange to temporarily halt operations.
Bitkub Defends Actions and Confirms Customer Fund Protection
In a statement released July 23, Bitkub defended its actions, assuring clients that all current customer holdings remain safe and fully accounted for. The exchange confirmed that leadership chose not to publicly disclose the cyberattack in May 2021 specifically to avert a run on the exchange, which could have destabilized the broader domestic crypto market.
Bitkub said its co-founders absorbed the loss by buying replacement assets in identical amounts and currencies, guaranteeing that customer funds remained intact. The exchange added that it reported the cyber theft to law enforcement authorities on May 10, 2021, and continues to pursue legal remedies against the perpetrators. It emphasized that its operations, security standards, and governance have since been significantly upgraded under independent board oversight.
Bitkub, which reportedly explored a Hong Kong IPO in late 2025, stated that customer funds were fully protected throughout the incident period.
FAQ
What did Thailand's SEC accuse Bitkub of doing after the May 2021 hack?
Thailand's Securities and Exchange Commission accused Bitkub Online Co. Ltd. and two former directors of submitting false financial reports by failing to reflect the $50 million loss in daily net capital reports (Form DA 1) from May 10 to Oct. 30, 2021, allegedly misleading regulators into believing customer assets were intact.
How did Bitkub respond to the SEC's criminal complaint?
In a statement released July 23, Bitkub defended its actions by stating that co-founders absorbed the loss by purchasing replacement assets in identical amounts and currencies, ensuring customer funds remained fully intact. The exchange reported the cyber theft to law enforcement on May 10, 2021, and chose not to publicly disclose the attack to prevent a potential run on the exchange.
What happens next in the case against Bitkub?
The criminal complaint has been handed to Thailand's Economic Crime Suppression Division (ECD) for investigation. After the investigation, prosecutors will determine whether to formally indict Bitkub and the two former directors, Sakolkorn Sakavee and Thaweesap Rawan.
