Thailand’s Securities and Exchange Commission (SEC) has filed a criminal complaint against cryptocurrency exchange Bitkub Online Co. Ltd., one of Thailand’s largest digital asset trading platforms by volume, over allegations tied to regulatory reports submitted after a major cyberattack in 2021.

The complaint also names two former Bitkub directors, Sakolkorn Sakavee and Thaweesap Rawan, in connection with claims that the exchange submitted false regulatory filings following the incident.

May 2021 cyberattack

The case relates to a cyberattack in May 2021, when hackers stole 16 types of digital assets worth about 1.7 billion baht (approximately $50 million at the time) from Bitkub.

Bitkub later replaced the stolen assets. However, according to the SEC, the replacement process did not begin until 31 October 2021, nearly four months after the attack.

The regulator said Bitkub’s Form DA 1 daily net capital reports between 10 May and 30 October 2021 showed no significant change in the company’s assets, even though the exchange had disclosed the financial impact of the cyberattack.

The SEC alleged that those filings contained false statements. It identified former directors Sakolkorn Sakavee and Thaweesap Rawan as the officials responsible for submitting the reports, and accused them of making inaccurate entries in company records.

The matter has been referred to Thailand’s Economic Crime Suppression Division (ECD) for investigation. Prosecutors will determine later whether formal charges should be filed, after which the case could move to court.

Bitkub’s response

Bitkub said in response that the SEC complaint concerns only reporting decisions made between May and October 2021 and does not affect the company’s current operations.

The exchange said all customer assets remain safe, fully backed, and compliant with custody regulations.

Bitkub said it intentionally withheld details of the 2021 cyberattack at the time to prevent a bank run, arguing that mass withdrawals would have made it more difficult to replace the lost funds.

The company also said its co-founders ensured that customers suffered no losses by personally purchasing replacement digital assets in the same currencies and values as those that had been stolen.

Bitkub further stated that, during an inspection in September 2025, the SEC confirmed that customer assets were safe.

Security measures and current position

Bitkub maintained that the 2021 incident was a cyberattack, not internal fraud. It also said that while its security systems complied with legal requirements at the time, they have since been significantly upgraded.

The company said it now holds certifications including ISO 27001, ISO 27701, and SOC 2 Type I. It also cited compliance with the NIST Cybersecurity Framework, annual SEC security audits, and partnerships with BitGo and Coinbase Custody as part of its customer asset protection framework.

Bitkub also warned that it may take action against anyone spreading false information about its financial condition or customer asset custody.

The case highlights the growing emphasis regulators are placing on the accuracy and timeliness of post-incident disclosures from crypto exchanges, an area that has drawn scrutiny globally following major industry failures. Thailand, which has regulated digital assets under a dedicated legal framework since 2018, has continued to tighten oversight of the sector. The development comes as Thailand’s SEC has recently proposed changes to the current derivatives licensing framework that would include crypto companies.