Thailand’s Bitkub faces criminal complaint over 1.7B-baht hack reports – Details

 The Securities and Exchange Commission (SEC) of Thailand has filed a criminal complaint against the crypto exchange Bitkub Online Co. Ltd.

Two of its former directors were also named in the complaint concerning claims that the cryptocurrency exchange filed fake regulatory reports after a significant cyberattack in 2021.

What happened back in 2021? 

The case stemmed from a cyberattack in May 2021. Hackers stole 16 types of digital assets worth approximately 1.7 billion baht.

Bitkub later replaced the stolen assets. However, the SEC said replacements only began on the 31st of October 2021. That was almost four months after the attack.

According to the SEC, Bitkub showed no significant change in its assets despite disclosing the financial impact of the hack in its Form DA 1 daily net capital reports between the 10th of May and the 30th of October 2021.

The SEC says these filings included false statements, citing former directors Sakolkorn Sakavee and Thaweesap Rawan as the officials in charge of turning in the reports and charging them with inaccurate entries into company records.

The SEC referred the matter to Thailand’s Economic Crime Suppression Division [ECD] for investigation. Prosecutors will later decide whether to file formal charges. The matter could then proceed to court.

Bitkub’s argument

In response, Bitkub stated that the SEC’s complaint pertains only to reporting choices taken between May and October 2021 and has no bearing on its present operations. The exchange underlined that all client assets are still compliant with custody rules, completely backed, and safe.

Bitkub claimed to have purposefully omitted specifics of the 2021 hack to prevent a bank run, citing mass withdrawals as making it challenging to replace the lost funds.

The company also said that its co-founders made sure customers suffered no losses by personally buying replacement digital assets in the same currencies and values as those lost. It also mentioned that during a September 2025 inspection, the SEC verified that consumer assets were safe.

Steps taken by the crypto exchange

Bitkub maintained that the 2021 incident was a cyberattack rather than internal fraud and that, although at the time its security systems complied with legal criteria, they have since been greatly upgraded.

To further strengthen customer asset protection, the firm now has certifications including ISO 27001, ISO 27701, and SOC 2 Type I. Along with that, it also has compliance with the NIST Cybersecurity Framework, annual SEC security audits, and alliances with BitGo and Coinbase Custody.

Bitkub also warned it may act against anyone spreading false information about its financial situation or customer asset custody. 

This coincided with Thailand’s SEC recently suggesting a change to the present licensing system for the derivatives business to include crypto companies.

Final Summary

• The complaint traces back to a May 2021 cybercrime in which Bitkub saw hackers steal sixteen different kinds of digital assets worth 1.7 billion baht.
• In its defense, Bitkub said that the 2021 incident was a cyberattack rather than internal fraud.