Thailand SEC files complaint against Bitkub over $50M hack concealment

Thailand's Securities and Exchange Commission filed a criminal complaint against Bitkub Online and two former directors, alleging the exchange submitted false daily net capital reports for nearly six months after a May 2021 cyberattack that stole 1.7 billion baht ($50 million) in digital assets.

"The daily reports submitted between May 10 and Oct. 30, 2021, did not reflect the material reduction in the company's digital asset holdings caused by the theft," the SEC said in its July 23 announcement, citing violations of Section 76 of the Emergency Decree on Digital Asset Businesses B.E. 2561.

The cyberattack on May 10, 2021, saw attackers drain 16 types of cryptocurrencies from Bitkub's wallets. The exchange's co-founders later purchased equivalent digital assets to cover the losses, fully replenishing holdings by Oct. 31, 2021, according to the company. Former directors Sakolkorn Sakavee and Thaweesap Rawan, who were responsible for submitting the Form DA 1 reports during the period, face additional charges under Section 88(2) for making false entries in company documents.

The case now moves to Thailand's Economic Crime Suppression Division for investigation before prosecutors decide whether to pursue charges. The complaint comes as Bitkub's parent company weighs a potential initial public offering, including a possible listing in Hong Kong, putting renewed scrutiny on governance at one of Thailand's largest crypto exchanges, which CoinGecko data shows had about $712 million in daily trading volume.

Co-founder Admits Altering Reports

On the evening the complaint became public, Sakolkorn posted a video on Facebook acknowledging he had altered and signed the DA 1 reports to conceal the hack from regulators and the public. He said the decision was his alone and that no other director or employee was aware of it, adding that he used personal funds to cover the losses so no customer was affected. He has since resigned from all positions connected to the company and said he would cooperate with the SEC's effort to identify the hacker.

Bitkub said in a statement that the person responsible for disclosure at the time chose not to report the theft because of fears of a bank run that could have triggered mass withdrawals, potentially leaving the company unable to replace the missing assets in time. The company maintained that all customer assets remained fully intact, noting that the SEC confirmed this during an inspection on Sept. 8, 2025.

The exchange said it reported the hack to police at the time it occurred and has since upgraded its security systems, which it says now rank in the top 20 globally according to CER.live. Bitkub has also partnered with custody providers BitGo and Coinbase Custody.

The case signals that Thai regulators are scrutinizing not only cybersecurity but also the accuracy of financial reporting to the state, even when customer losses are ultimately covered. The SEC urged investors to use only licensed digital asset operators and to report suspected wrongdoing to its complaints hotline.

This article is for informational purposes only and does not constitute investment advice.