Thailand's Securities and Exchange Commission has filed a criminal complaint against cryptocurrency exchange Bitkub Online Co., Ltd. and two former directors, accusing them of submitting false statements and misleading corporate documents tied to a major cyberattack in 2021.

The complaint was filed with the Economic Crime Suppression Division and represents the latest enforcement step connected to one of Thailand's largest cryptocurrency security incidents. Authorities allege that Bitkub did not accurately disclose the financial impact of the attack in regulatory filings. The former executives are alleged to have approved or submitted misleading information to regulators during the relevant period. The case underscores the Thai SEC's broad supervisory authority over digital asset platforms under the Emergency Decree on Digital Asset Businesses, in effect since 2018, which requires licensed exchanges to maintain minimum capital thresholds and submit daily financial reports.

Allegations Tied to the 2021 Cyberattack

According to the SEC, Bitkub was hit by a cyberattack in May 2021 that led to the theft of digital assets across 16 cryptocurrencies, with an estimated value of about 1.7 billion baht. Regulators allege that the exchange continued to file daily net capital reports from May 10 to October 30, 2021, without reflecting the material reduction in assets caused by the theft.

The SEC alleges that Bitkub submitted false statements in required regulatory reports. It also alleges that two former directors were responsible for filing those reports during the period in question.

In addition, the regulator claims the former executives made false entries in company documents that were intended to mislead regulators into believing customer assets had not been affected and that no damage had occurred.

The SEC said the alleged conduct may violate provisions of Thailand's Emergency Decree on Digital Asset Businesses. The complaint has triggered a formal investigation into the matter.

Bitkub Issues Response

After the SEC's announcement, Bitkub said the case concerns only reporting practices related to events that occurred between May and October 2021. The company stressed that customer assets currently held on the platform remain safe and fully intact.

Bitkub also said the underlying incident was not the result of fraudulent conduct by the individuals named in the complaint. According to the exchange, the matter relates to historical disclosure decisions made after the cyberattack, rather than the present security of customer funds.

The filing of a criminal complaint does not amount to a conviction. Under Thailand's legal process, investigators will examine the allegations before prosecutors decide whether to pursue formal charges. Any final ruling would be determined by the courts. The outcome of this case may signal how Thai regulators approach disclosure and reporting obligations for a sector that has grown rapidly under the 2018 regulatory framework, which positioned Thailand among Southeast Asia's more proactive jurisdictions in licensing and supervising digital asset businesses.