Thai SEC Charges Bitkub for Allegedly Covering Up $50 Million Hack

On July 23, 2026, the Thai Securities and Exchange Commission (SEC) filed criminal charges against Bitkub Online Co., Thailand's largest cryptocurrency exchange, and two former directors. This action follows allegations that they intentionally concealed a cyberattack that occurred five years ago in 2021, involving 1.7 billion baht (approximately $50 million), and submitted false reports to regulatory authorities.

According to the SEC's complaint, Bitkub did not immediately report the theft of 16 types of digital assets resulting from a hack in May 2021. The accused include former directors Sakolkorn Sakavee and Thaweesap Rawan, who are charged with manipulating internal company documents to deceive regulators into believing that customer assets were being kept safe.

Bitkub failed to mention any significant asset losses in the daily net capital reports (Form DA 1) submitted from May 10 to October 30, 2021, which was an intentional act to hinder regulatory authorities from understanding the company's actual financial condition.

This security incident, which occurred in May 2021, was an attack targeting vulnerabilities in the Bitkub system, resulting in the outflow of massive assets worth approximately 1.7 billion baht at the time. Investigations revealed that hackers accessed the exchange's hot wallets and stole a total of 16 types of assets, including major cryptocurrencies such as Bitcoin and Ethereum.

Mechanism of False Reporting and Concealment Tactics

The SEC pointed out that Bitkub included false information in the 'Form DA 1' reports, which must be submitted daily, for about five months immediately following the hack. Regulatory authorities believe that the former directors intentionally manipulated the books and recorded false facts to make it appear as though customer assets remained intact and the company had suffered no damages.

• May 2021: A cyberattack resulted in the theft of 16 types of digital assets worth 1.7 billion baht.
• May 10, 2021 – October 30, 2021: Submission of false daily net capital reports that omitted the fact of the loss.
• October 31, 2021: Bitkub co-founders fully replenished the stolen assets with their own funds.

Regarding this complaint, Bitkub explained that there was no actual loss of customer assets and that the decision not to disclose the incident at the time was a strategic judgment to prevent market panic and a mass withdrawal (bank run). The company emphasized that because the co-founders immediately replenished the assets, customer funds remained 100% safe, and that this incident was a matter of management's choice regarding the timing of disclosure, not fraud.

Furthermore, Bitkub stated that at the time of the 2021 incident, it immediately reported the matter to the police, pursued legal procedures such as tracking the hackers, and subsequently upgraded its security system to a level within the global top 20. The exchange reaffirmed that all operations are currently running normally and that customer assets are fully protected.

Regulatory Verification and Future Legal Procedures

The Thai SEC confirmed during an on-site inspection conducted on September 8, 2025, that Bitkub's customer assets were being kept safely. However, the regulatory authority determined that, regardless of the subsequent replenishment of assets or their current safety, the act of filing false reports in 2021 itself was a serious violation of regulations that undermined market transparency.

This case has been referred to the Thai Economic Crime Suppression Division (ECD) for further investigation. The SEC's action is interpreted as a demonstration of its resolve to hold entities strictly accountable for past violations, emphasizing that the accuracy of reports submitted by cryptocurrency operators to regulatory authorities is the core of market trust.

Bitkub Investigation and Regulatory Response Timeline

The timeline below shows the major developments of the Bitkub case from the time of the 2021 hacking to the SEC's criminal complaint in July 2026.