Thailand SEC files criminal complaint against Bitkub over 2021 cyberattack reports

Complaint over 2021 filings

The Thailand Securities and Exchange Commission said the complaint was submitted to the Economic Crime Suppression Division. It names Bitkub Online as well as former directors Sakolkorn Sakavee and Thaweesap Rawan.

According to the regulator, the case concerns entries made between May 10 and Oct. 30, 2021. The SEC alleges the exchange made false statements in official documents following a cyberattack in May 2021 that affected 16 types of digital assets.

Alleged omission of losses

The SEC said its investigation found that Bitkub did not reflect the losses from the attack in its daily net capital reports, known as Form DA 1, during that period. In the regulator’s account, this meant the company’s filings presented customer assets as if they remained complete and suggested the business had not suffered financial damage.

The alleged conduct is being treated as false entries in official reports under Thailand’s Emergency Decree on Digital Asset Businesses B.E. 2561 (2018). The SEC said the exchange later obtained replacement assets by late October 2021, but maintains that the reporting gap in the intervening months still amounted to false statements.

Bitkub’s response

Bitkub disputed the broader implications of the case and said current customer holdings are safe and fully accounted for. The exchange said it chose not to publicly disclose the cyberattack at the time because management feared a run on the platform that could have destabilized Thailand’s domestic crypto market.

The company also said its co-founders covered the losses themselves by buying replacement assets in the same amounts and currencies as those stolen. Bitkub added that it reported the cyber theft to law enforcement on May 10, 2021.

Next steps in the case

The matter now moves to local police for further investigation. Prosecutors will later decide whether to bring indictments against the company and the two former directors.

Bitkub said its operations, security and governance have since been strengthened and are now subject to oversight by an independent board. The SEC’s complaint, however, focuses specifically on whether the exchange’s regulatory filings during the months after the hack concealed the losses from authorities.

The case places renewed attention on how digital asset platforms report security incidents and capital positions to regulators, particularly when customer balances are later restored. In this instance, the core dispute is not whether replacement assets were eventually secured, but whether official filings accurately reflected the company’s position in the period immediately after the breach.