Thailand SEC Files Criminal Complaint Against Bitkub Over 2021 Hack Reporting

Thailand’s Securities and Exchange Commission has filed a criminal complaint against Bitkub, the country’s largest domestic cryptocurrency exchange, and two former directors over alleged false regulatory filings tied to a 2021 hack that the regulator says resulted in the theft of about 1.7 billion baht in customer digital assets.

The SEC said July 23, 2026, that it filed the complaint with the Economic Crime Suppression Division, a Thai police unit that handles financial crime cases. The complaint names Bitkub Online Co., Ltd. and former directors Sakolkorn Sakavee and Thaweesap Rawan, whom the SEC said were responsible for submitting the exchange’s daily net capital reports, known as Form DA 1, during the period in question. According to the regulator, those filings from May 10, 2021, through Oct. 30, 2021, failed to reflect a material change in asset balances after the theft and therefore contained false statements.

“The Securities and Exchange Commission (SEC) has filed a criminal complaint with the Economic Crime Suppression Division (ECD) against Bitkub Online Co., Ltd. (Bitkub) and its former directors for giving false statements to the SEC…” the agency said in its statement. The complaint is an allegation, not a court finding.

The SEC said Bitkub was hit by a cyberattack in May 2021 in which digital assets across 16 cryptocurrencies were stolen. The regulator valued the stolen assets at about 1.7 billion baht, or roughly $50 million at late-July 2026 exchange rates. The agency’s case focuses on what it says happened in the exchange’s reporting afterward, rather than on the hack alone.

Bitkub said in a public statement on July 23 that the incident dates to May through October 2021 and that customer assets are currently “safe and complete.” The company said its co-founders replaced the stolen assets by Oct. 31, 2021, and that customers did not ultimately suffer losses. Bitkub also said it did not publicly disclose the theft at the time because it wanted to avoid a “bank run,” and that it filed a police report on May 10, 2021, to pursue the attackers.

The SEC said the alleged offenses fall under Thailand’s Emergency Decree on Digital Asset Businesses B.E. 2561, or 2018, the law that licenses and regulates digital-asset businesses in the country. The agency cited Section 76, covering false statements to the regulator; Section 88(2), covering false entries in juristic-person documents; and Section 94, which can impose liability on directors when a company’s offenses result from their acts or failure to act. Those provisions can carry criminal penalties, including fines and possible imprisonment.

The case is significant because Bitkub is widely regarded as Thailand’s largest domestic crypto exchange, making the complaint a closely watched test of disclosure and capital-reporting obligations at a licensed trading platform. Daily net capital reporting is meant to show whether a regulated firm has sufficient assets and financial stability to operate.

The SEC said the matter will now move through a police inquiry, review by a public prosecutor and, if charges are pursued, court adjudication. The regulator said it would continue cooperating with the authorities as the case proceeds.