Thailand SEC Files Criminal Complaint Against Bitkub Over 2021 Cyberattack Disclosure Failures

Thailand’s SEC Intensifies Enforcement Against Bitkub Over Disclosure Failures

Thailand’s Securities and Exchange Commission has filed a criminal complaint against Bitkub Online, one of Asia’s most established cryptocurrency exchanges, along with two former company directors. The charges allege that the platform provided false or misleading information to regulators regarding a significant 2021 security breach, marking an important enforcement action in Thailand’s evolving regulatory approach to digital asset trading platforms. This case reflects growing regulatory focus on transparency and governance standards within the cryptocurrency industry, particularly regarding how exchanges handle and disclose the impact of security incidents.

The 2021 Cyberattack and Reporting Discrepancies

According to Thailand’s Securities and Exchange Commission, an unauthorized cyberattack in May 2021 compromised Bitkub’s systems and resulted in the theft of digital assets valued at approximately 1.7 billion baht (about $50 million) across 16 asset types. The regulator’s complaint centers on the company’s alleged failure to accurately reflect this loss in its regulatory reporting. Although Bitkub restored the stolen assets by October 31, 2021, the SEC alleges that daily net liquid capital reports filed between May 10 and October 30, 2021, did not show the substantial reduction in assets that should have resulted from the breach. This omission, regulators argue, created a misleading impression that customer holdings remained unchanged and that the exchange had not suffered any losses from the attack. The SEC specifically named former Bitkub directors Sakolkorn Sakavee and Thaweesap Rawan, who were responsible for submitting these reports during the investigation period.

Company’s Response and Institutional Implications

Bitkub has pushed back against the allegations, framing the disclosure gap as a strategic choice rather than fraudulent conduct. The exchange explained that it deliberately delayed publicizing the wallet compromise to prevent triggering a bank run while it worked to address the stolen funds. According to Bitkub, its co-founders subsequently purchased equivalent digital assets to restore customer balances, ensuring that neither the company nor its customers experienced financial losses from the incident. The platform stated it has since upgraded its governance, compliance, and security infrastructure to strengthen safeguards against future breaches.

The timing of this enforcement action carries significant implications for Bitkub’s business prospects. The exchange, founded in 2018, has established itself as Thailand’s premier crypto trading platform, ranking first among domestic exchanges by trust score and processing approximately $712 million in daily trading volume. More critically, Bitkub’s parent company has been actively exploring a potential public listing, with a December 2025 announcement indicating interest in Hong Kong stock market listing. The SEC’s criminal complaint introduces substantial regulatory uncertainty into those IPO plans and may intensify institutional investor scrutiny of the company’s internal controls and management practices.

The case illustrates broader tensions in cryptocurrency regulation between operational security imperatives and transparent reporting requirements. As exchanges worldwide navigate evolving regulatory frameworks, this enforcement action demonstrates that regulators are willing to pursue criminal remedies when they determine that disclosure standards have been compromised.

Heightened regulatory scrutiny of major exchanges strengthens the broader cryptocurrency ecosystem by incentivizing governance practices that protect users and institutional confidence.

Source: Thailand Securities and Exchange Commission, via Cointelegraph. Not financial advice.