Thailand's Securities and Exchange Commission (SEC) has filed a criminal complaint against Bitkub Online and two former directors, accusing the exchange of providing false information to regulators in connection with a 2021 cyberattack. The action represents one of the most significant enforcement steps taken under Thailand's digital asset regulatory framework, which has governed licensed exchanges since the Digital Asset Act took effect in 2018.

The complaint, announced on Thursday, names former Bitkub directors Sakolkorn Sakavee and Thaweesap Rawan, whom the SEC identified as responsible for submitting the company's reports during the period under investigation. The case is now advancing through investigation, potential prosecution, and court proceedings.

SEC Allegations: Undisclosed Impact of a $50 Million Hack

According to the SEC, a cyberattack in May 2021 resulted in the theft of 16 types of digital assets from Bitkub, valued at approximately 1.7 billion baht ($50 million). The regulator alleges that Bitkub replaced the stolen assets by October 31, 2021, but failed to accurately reflect the impact of the incident in its daily net liquid capital reports.

The SEC contends that reports submitted between May 10 and October 30, 2021 showed no significant reduction in the exchange's assets following the theft, creating the impression that customer holdings remained intact and that the exchange had sustained no losses. The regulator accuses Bitkub and the former directors of violating multiple provisions of Thailand's digital asset regulations. The complaint underscores the emphasis Thai regulators place on continuous disclosure obligations for licensed digital asset operators, who are required to submit periodic financial reports to the SEC as a condition of their operating licenses.

The SEC's announcement is available on its official website. The Bangkok Post also reported on the complaint.

Bitkub: Disclosure Was Delayed to Prevent a Bank Run

Bitkub disputed the SEC's allegations in a post on X, stating that the case concerns disclosure decisions made after the May 2021 cyberattack rather than any fraudulent conduct. The exchange explained that it delayed disclosing the wallet compromise to prevent a bank run while working to address the loss. The exchange's rationale highlights a tension that crypto exchanges globally have faced when handling security incidents: the competing demands of immediate regulatory transparency and the risk of customer panic withdrawals.

The company said its co-founders subsequently purchased equivalent digital assets to cover the stolen funds, and that neither the company nor its customers suffered financial losses as a result. Bitkub also stated that it has since strengthened its governance, compliance, and security systems.

Context: Market Position and IPO Considerations

Founded in 2018, Bitkub has grown into one of Thailand's largest cryptocurrency exchanges. According to CoinGecko, the platform ranks first among Thai crypto exchanges by trust score and recorded approximately $712 million in daily trading volume at the time of publication.

The SEC complaint comes as Bitkub's parent company explores a potential public listing. In December 2025, Bitkub confirmed to Cointelegraph that it was considering an initial public offering (IPO), including a possible listing in Hong Kong. A criminal complaint from regulators during a pre-IPO period could add complexity to any listing process, as exchanges and securities regulators in multiple jurisdictions typically scrutinize outstanding legal matters during their review of offering candidates.

Cointelegraph reached out to Bitkub for additional comment on the SEC's complaint and its IPO plans but had not received a response by publication time.