Thailand's Securities and Exchange Commission has filed a criminal complaint against crypto exchange Bitkub Online and two former directors over alleged false regulatory reporting following a significant cyberattack. According to the SEC announcement published on July 23, 2026, the complaint targets Bitkub, former directors Sakolkorn Sakavee and Thaweesap Rawan over information submitted in the exchange's daily net liquid capital reports following the May 2021 hack. The regulator alleged that reports filed between May 10 and October 30, 2021, did not accurately show the reduction in the exchange's digital asset holdings after attackers stole 16 different cryptocurrencies worth approximately ₹140 crore ($50 million). The complaint, filed with the Royal Thai Police, seeks to hold the exchange accountable for what the SEC describes as a violation of the Securities and Exchange Act. The case comes as Bitkub's parent company considers a potential public listing, putting renewed attention on transparency and governance at one of Thailand's most prominent crypto businesses.
The SEC's complaint alleges that the omission of stolen asset information created the impression that customer assets remained intact and that the exchange had not suffered losses from the incident. As reported by the SEC, the stolen assets were replaced by October 31, 2021, but authorities argued that the impact of the theft should have been reflected in the reports submitted during the period. The regulator claims Bitkub failed to properly account for the stolen assets, potentially misleading investors and the public about its financial health. The SEC alleges that former directors Sakolkorn Sakavee and Thaweesap Rawan made false statements in company documents to deceive the regulator, with the matter now moving through the country's criminal investigation process before any decision on prosecution or court proceedings. The case traces back to a cyberattack in May 2021 that resulted in the theft of 1.7 billion baht worth of digital assets, with the problem being everything that happened in between the breach and the replacement of stolen assets.
Responding to the SEC allegations, Bitkub disputed the regulator's characterization of the case, stating it concerns decisions about when to disclose the wallet compromise rather than allegations of fraud or customer losses. According to Bitkub's statement, the exchange intentionally delayed announcing the incident because it wanted to prevent a potential bank run while working to recover from the theft. The company confirmed that its co-founders later purchased an equivalent amount of digital assets to replace the stolen funds, leaving customers and the company without financial losses. Bitkub also stated it has strengthened its governance framework, compliance procedures and security controls since the incident. The exchange has not yet issued a detailed public response to the specific allegations, though the case highlights the importance of due diligence when choosing a cryptocurrency platform. Bitkub's history with regulators adds context, as the company has previously faced insider-trading fines against its chief technology officer and civil penalties related to allegations of artificial trading volume manipulation.
In response to the SEC complaint, Bitkub has implemented comprehensive security upgrades and obtained multiple certifications to strengthen customer asset protection. The exchange now holds ISO 27001, ISO 27701, and SOC 2 Type I certifications, along with compliance with the NIST Cybersecurity Framework. Additionally, Bitkub has established partnerships with BitGo and Coinbase Custody and undergoes annual SEC security audits. During a September 2025 inspection, the SEC verified that customer assets remained safe and compliant with custody rules. The company maintains that the 2021 incident was a cyberattack rather than internal fraud, with security systems previously meeting legal criteria but now significantly upgraded. Bitkub has also warned it may take action against anyone spreading false information about its financial situation or customer asset custody.
Founded in 2018, Bitkub has grown into Thailand's largest cryptocurrency exchange, commanding over 90% of the local market share and holding the position as the country's largest licensed digital asset platform. The complaint comes as Bitkub continues to explore a public listing, with the company confirming in December 2025 that it was considering an initial public offering, including the possibility of listing in Hong Kong. The criminal complaint marks a significant development in Thailand's evolving cryptocurrency regulatory landscape and signals a more aggressive enforcement stance toward digital asset businesses operating in the country. If found guilty, Bitkub could face fines, trading suspensions, or other regulatory penalties, with the outcome potentially leading to stricter compliance requirements across the sector and affecting how all crypto exchanges handle user funds and report security incidents. The personal liability dimension is particularly significant, as charging former directors by name sends a clear message to executives at every licensed digital asset company in Thailand that compliance failures carry real personal legal consequences.
