Thailand's Securities and Exchange Commission has filed criminal complaints against cryptocurrency exchange Bitkub Online and two former directors, alleging that the company submitted false information about customer assets after a 2021 cyberattack.

Bitkub is one of Thailand's largest licensed digital asset exchanges and has been a central player in the country's growing crypto market, which regulators have overseen under the Digital Asset Businesses Emergency Decree since 2018.

The regulator said the complaint concerns mandatory reports that allegedly failed to reflect losses from unauthorized cryptocurrency withdrawals worth about 1.7 billion baht. The matter has been referred to Thailand's Economic Crime Suppression Division, which will investigate before prosecutors decide whether criminal charges should be filed.

The SEC said in an official announcement that the complaint does not amount to a conviction. Any criminal liability would be determined by prosecutors and the courts if the case advances.

According to the regulator, the complaint names former Bitkub directors Sakolkorn Sakavee and Thaweesap Rawan. The SEC said they were responsible for submitting the exchange's daily net capital reports during the period examined by authorities. Regulators allege that the reports did not show the financial effects of the cyberattack, even though the incident involved customer-held digital assets.

The allegations are tied to reporting requirements under Thailand's Digital Asset Businesses Emergency Decree, the framework that governs licensed digital asset operators in the country. Investigators will review whether the documents submitted by Bitkub accurately represented the exchange's financial position during the affected months.

SEC Alleges Reports Omitted Customer Asset Losses

The SEC said a cyberattack in May 2021 led to unauthorized withdrawals involving 16 cryptocurrencies held through Bitkub. Regulators estimated that the affected customer assets were worth approximately 1.7 billion baht.

According to the regulator, Bitkub submitted Form DA 1 reports from May 10 to October 30, 2021. The SEC alleges that those filings showed no material change in customer assets despite the theft. On that basis, the regulator argues that the reports gave an inaccurate view of the exchange's custody of customer funds.

Bitkub later began replacing the missing digital assets on October 31, 2021. However, investigators said the reports submitted before that date did not disclose the impact of the incident before the replacement was made.

The SEC cited Section 76 of Thailand's Digital Asset Businesses Emergency Decree, which addresses false statements submitted by licensed digital asset businesses. Regulators allege that the filings did not accurately reflect changes caused by the cyberattack.

Former Directors Accused Over Corporate Records

In addition to the reporting allegations, the SEC accused Sakolkorn and Thaweesap of recording false information in Bitkub's corporate documents. According to regulators, those records stated that no damage had occurred despite the loss of customer assets.

The complaint also cites Section 88(2), which concerns false entries in company records intended to deceive another party. Authorities allege that both former directors had key roles in preparing and submitting the disputed documents during the reporting period.

Investigators have not disclosed which cryptocurrencies were affected or the quantities involved. Bitkub had not issued a public response within the information released by the SEC.

Economic Crime Suppression Division to Investigate

The SEC has sent the complaint to Thailand's Economic Crime Suppression Division for further investigation. Inquiry officers will collect evidence, interview relevant parties, and assess whether there are sufficient grounds to recommend prosecution. Public prosecutors will then review the findings before deciding whether to file criminal charges.

Separately, the regulator reminded investors to use only licensed digital asset service providers. Officials warned that customers who deal with unauthorized operators may face fraud, withdrawal problems, and limited legal protection.

The SEC said investors can verify licensed companies through the SEC website and the SEC Check First application. The regulator also encouraged the public to report suspicious activity through Hotline 1207 and its official reporting channels.

The criminal complaint marks a further step in Thailand's review of Bitkub's handling of customer asset reporting after the 2021 cyberattack. The investigation remains ongoing, and any criminal liability will depend on the findings of investigators, prosecutors, and the courts.