Why Thailand's SEC Is Taking Bitkub to Court Over a Five-Year-Old Crypto Hack

Thailand's largest cryptocurrency exchange, Bitkub, is facing one of the country's most significant regulatory cases since digital assets became part of the financial system.

The Thai Securities and Exchange Commission (SEC) has filed a criminal complaint against Bitkub Online Co., Ltd. and two of its former directors, alleging that the company submitted false financial reports after suffering a major cyberattack in 2021 that resulted in the theft of digital assets worth approximately 1.7 billion baht.

Bitkub strongly disputes the allegations, arguing that its decisions were made to protect customers rather than deceive regulators. The dispute highlights a broader question facing the global cryptocurrency industry: when an exchange suffers a major hack, should it disclose the incident immediately—even if doing so could trigger panic—or should it first stabilize the platform?

What happened after the 2021 hack?

According to the SEC, Bitkub experienced a significant cyberattack in May 2021, during which hackers stole 16 different digital assets with an estimated value of 1.7 billion baht.

The regulator alleges that despite the losses, Bitkub continued submitting daily regulatory reports indicating that the exchange's financial position remained stable.

The reports in question are known as DA 1 filings, which licensed digital asset businesses must submit to demonstrate that they maintain sufficient net capital under Thai regulations.

The SEC claims that reports filed between May 10 and October 30, 2021 failed to reflect the financial impact of the hack.

According to investigators, Bitkub only began purchasing replacement digital assets in late October 2021, suggesting that earlier filings did not accurately represent the company's financial position.

Former executives also face investigation

The criminal complaint also names two former Bitkub directors:

• Sakolkorn Sakavee;
• Thaweesap Rawan.

The SEC alleges that they were responsible for preparing and submitting the daily reports following the cyberattack.

Regulators argue that the reports created the impression that customer assets remained fully intact and that the exchange had not suffered significant losses.

If prosecutors proceed with the case and the allegations are proven in court, the former executives could face criminal liability under Thailand's Digital Asset Business Act.

Why Bitkub says it delayed disclosure

Bitkub offers a very different interpretation of the events.

According to the company, the issue is not customer losses but the timing of public disclosure.

The exchange argues that immediately announcing the hack could have triggered a classic bank run, in which thousands of customers simultaneously attempted to withdraw their assets.

Such a wave of withdrawals, Bitkub says, might have prevented the company from replacing the stolen assets quickly enough, potentially causing real financial losses for customers.

Instead, management chose to quietly replenish the missing cryptocurrencies before publicly addressing the incident.

The company insists this strategy prevented panic and ultimately protected users.

Customers reportedly suffered no losses

Bitkub says the stolen assets were never recovered from the attackers.

Instead, the exchange's shareholders purchased replacement digital assets using their own funds until every customer balance had been fully restored.

According to the company:

• no customer lost cryptocurrency;
• customer wallets remained fully backed;
• the exchange avoided a broader crisis of confidence in Thailand's crypto market.

Bitkub also notes that during a regulatory inspection in September 2025, the SEC confirmed that all customer assets were present.

The case is about disclosure—not the hack itself

Importantly, the SEC is not accusing Bitkub of causing the cyberattack.

Instead, the central issue is whether the company fulfilled its legal obligation to provide accurate financial information to regulators.

Financial regulators generally require licensed institutions to disclose material events that could affect their financial condition or the protection of customer assets.

The SEC argues that investors and regulators must receive accurate information regardless of whether management intends to reimburse losses later.

Bitkub, meanwhile, argues that immediate disclosure would have increased the overall risk to customers by creating unnecessary panic.

The disagreement reflects a difficult balance between market transparency and financial stability, an issue that has appeared in banking and financial markets long before cryptocurrencies existed.

Security has changed significantly since 2021

Bitkub says the exchange has substantially strengthened its security systems following the incident.

The company now reports using:

• ISO 27001, ISO 27701, and SOC 2 Type I security certifications;
• the NIST Cybersecurity Framework;
• Passkey authentication;
• a Self-Freeze emergency account protection feature;
• institutional custody through BitGo Trust Company and Coinbase Custody Trust Company.

According to Bitkub, the platform also undergoes regular regulatory inspections and ranks among the world's safer cryptocurrency exchanges according to independent security assessments.

What happens next?

The SEC has submitted its criminal complaint to Thailand's Economic Crime Suppression Division (ECD).

Investigators will review the evidence before prosecutors decide whether formal criminal charges should be filed.

If prosecutors determine there is sufficient evidence, the case will proceed to court, where judges will ultimately determine whether Bitkub's reporting violated Thai law.

The outcome could become one of the most important legal precedents for cryptocurrency disclosure requirements in Thailand and may influence how digital asset exchanges handle future cybersecurity incidents.