Thailand's SEC files lawsuit against Bitkub over 2021 hacking report

Thailand's cryptocurrency market encounters regulatory pressure again: SEC sues Bitkub over 2021 hacking incident

Thailand's cryptocurrency market is facing a new round of regulatory pressure after the country's Securities and Exchange Commission (SEC) filed criminal charges against Bitkub and two former directors, accusing them of inaccurate disclosure of information related to the 2021 cyber attack.

In a report released Thursday, the Thai SEC said it had filed a lawsuit against Bitkub Online and former executives Sakolkorn Sakavee and Thaweesap Rawan, accusing them of misstating the impact of the hack in company reports filed during the investigation. The case comes at a sensitive time for Bitkub, as its parent company has been considering a potential public listing-which typically imposes stricter transparency and governance requirements.

Core Points

Thailand's SEC has filed criminal charges against Bitkub Online and two former directors, accusing them of involving false reports of cyber attacks in May 2021. The SEC stated that Bitkub failed to fully reflect the full impact of asset theft in its daily net liquid asset report for the period from May 10 to October 30, 2021. Regulators estimate that the stolen crypto assets involved 16 categories and were worth approximately 1.7 billion baht (approximately US$50 million). Bitkub disputed the SEC's allegations, saying the delay in disclosure was to avoid a run and subsequently covered the stolen assets with equivalent assets. The case will move into Thailand's investigation and possible prosecution process, while Bitkub's broader corporate plans remain the focus.

SEC accuses Bitkub of underestimating losses in capital report

The core of this complaint is that the SEC believes that Bitkub failed to accurately disclose the consequences of the May 2021 hacking attack. According to the SEC, the incident led to the theft of 16 categories of digital assets from the exchange, with a stated value of approximately 1.7 billion baht (approximately US$50 million). The SEC further alleges that Bitkub replaced stolen assets before October 31, 2021. However, the exchange's daily net current asset report for the period from May 10 to October 30, 2021 did not show a significant decrease in assets. In the SEC's view, this reporting gap could create the impression that client assets were largely unaffected and that the exchange did not suffer significant losses from the attack. The complaint accuses Bitkub and two former directors of violating multiple provisions of Thailand's digital assets regulations in connection with alleged false disclosures. The SEC said the matter will enter the investigation stage and will be prosecuted and tried in court if necessary.

Bitkub refutes: Disclosure timing is intended to prevent runs

Bitkub posted on the X platform refuted the SEC's allegations, saying the complaint stemmed from a disclosure decision after the May 2021 cyber attack and not fraudulent intent. The exchange said it delayed disclosing the stolen wallet in order to prevent runs while trying to resolve losses. Bitkub also pointed out that its co-founders later purchased digital assets equivalent to the stolen funds, arguing that neither the company nor its customers ultimately suffered financial losses. While refuting, Bitkub said it has since strengthened its governance, compliance and security systems. The exchange did not say it would change or withdraw its position, but its response described the controversy as a risk management battle over timing and communication rather than a concealment of ongoing damage.

Why is the case so significant as Bitkub considers going public

In addition to direct legal proceedings, the SEC's complaint comes as Bitkub's ownership group is considering a potential public listing. This context is important because the open market path typically puts greater pressure on the quality of information disclosure, internal controls and auditability, especially for regulated exchanges. Even if Bitkub's parent company continues to move forward with financing or IPO plans, regulatory review of past reporting practices may affect investor sentiment, due diligence results, and the intensity of review by potential underwriters or listing authorities. At the same time, the case highlights potential contradictions in cryptocurrency regulation in multiple jurisdictions: whether companies 'efforts to stabilize the situation after the incident can justify delayed or incomplete public disclosures, and what regulators define as "accurate" reporting during this transition period.

Bitkub's scale in Thailand and its subsequent focus

Bitkub was established in 2018 and has become one of the most well-known cryptocurrency exchanges in Thailand. For market participants, SEC complaints may affect counterparties and users 'assessments of compliance and reporting standards, especially for an exchange that already has a significant market share. Although Bitkub disputes the allegations, the next stage will depend on the progress of Thailand's investigation and any subsequent prosecution decisions. Readers should pay attention to: whether regulators can prove that the dispute report materially misled stakeholders; how Bitkub confirms its claims for subsequent compensation; and whether more documents have surfaced to clarify the timeline for disclosures related to the May 2021 hacking incident. As the legal process progresses and the IPO plan remains a background factor, transparency in internal controls and incident communication may become a key factor for regulators and investors to judge Bitkub.