Bitkub Online Co. Ltd., a major crypto exchange in Thailand, is facing a criminal complaint after a 2021 hack exposed gaps in its reporting. The Securities and Exchange Commission (SEC) alleges that Bitkub submitted false financial statements following a cyberattack that resulted in the theft of digital assets valued at around 1.7 billion baht.
Details of the 2021 Cyberattack and SEC’s Allegations
In May 2021, hackers seized 16 types of cryptocurrencies from Bitkub's platform, with the stolen assets amounting to approximately 1.7 billion baht. Bitkub replaced the lost assets months later, only starting the restitution process at the end of October 2021. Despite reporting the financial impact of the hack in their daily net capital reports (Form DA 1) during the period from May 10 to October 30, the SEC claims the exchange showed no real change in its asset status. This suggests that the filings may have contained misleading information.
The SEC’s complaint specifically names two former directors, Sakolkorn Sakavee and Thaweesap Rawan, accusing them of submitting inaccurate records. The case has been handed over to Thailand’s Economic Crime Suppression Division for further investigation, with the possibility of prosecution and court proceedings.
Bitkub’s Response and Security Enhancements
Bitkub argues that the complaint concerns past reporting choices and does not reflect current operations. The company insists that all client assets remain fully backed and comply with custody regulations. To avoid triggering a bank run, Bitkub says it intentionally withheld detailed disclosures about the hack at the time, citing the risk of mass withdrawals that could have hindered asset replacement.
The exchange also highlighted that its co-founders personally covered losses by acquiring replacement cryptocurrencies equivalent in value and type to those stolen. A recent SEC inspection in September 2025 confirmed the safety of consumer assets.
Following the 2021 incident, Bitkub significantly upgraded its security measures. The company now holds certifications like ISO 27001, ISO 27701, and SOC 2 Type I, complies with the NIST Cybersecurity Framework, undergoes annual SEC security audits, and partners with custodians such as BitGo and Coinbase Custody.
Bitkub warned it will take action against anyone spreading misinformation about its financial health or asset custody. This controversy emerges as Thailand’s SEC considers expanding licensing rules for derivatives businesses to include cryptocurrency companies.
