SEC files criminal complaint against Bitkub and former directors over alleged false reporting

The Securities and Exchange Commission (SEC) has filed a criminal complaint against Bitkub Online Co Ltd and two former company directors with the Economic Crime Suppression Division (ECD) over alleged false statements submitted to the regulator.

The case concerns alleged offences under Section 76 of the Emergency Decree on Digital Asset Businesses B.E. 2561 (2018), with the two former directors also facing liability under Section 94 of the same decree.

The SEC also filed a complaint against the former directors for allegedly making false entries in the documents of a juristic person to deceive others, an offence under Section 88(2), punishable under the final paragraph of Section 88 of the Digital Asset Business Decree.

According to the SEC, in May 2021, Bitkub was hit by a cyberattack in which 16 types of digital assets were stolen. The attack resulted in some customer digital assets being removed from the digital asset exchange, with an estimated value of around 1.7 billion baht.

The SEC later found information indicating that Bitkub had procured replacement digital assets for those stolen from October 31, 2021.

However, the SEC said its investigation found that Bitkub did not report the incident consistently in its daily net capital report, or Form DA 1. The reports submitted from May 10, 2021, to October 30, 2021, did not show any significant change in Bitkub’s assets arising from the theft, which the SEC said constituted the submission of false statements.

The SEC identified Sakolkorn Sakavee and Thaweesap Rawan, then directors of Bitkub, as the persons responsible for submitting Form DA 1 during the incident period. The SEC said both individuals were therefore liable in the same manner as Bitkub under Sections 94 and 76 of the Digital Asset Business Decree.

The regulator also said Sakolkorn and Thaweesap made false entries in Form DA 1, a company document, to mislead the SEC into believing that customers’ assets were being kept normally and that Bitkub had suffered no damage.

The SEC has therefore filed a criminal complaint against three parties: Bitkub Online Co Ltd, Sakolkorn Sakavee and Thaweesap Rawan, both now former directors of Bitkub, with the ECD for further legal proceedings.

After the SEC’s complaint, the criminal enforcement process will proceed through police investigation, prosecutors’ consideration of whether to indict, and the court process.

The SEC said it would monitor the case and fully cooperate with relevant agencies to support enforcement of the Digital Asset Business Decree.

The SEC also warned the public and investors to exercise caution when using services from unauthorised digital asset operators, as they are not protected under the law and may face risks of scams and money laundering. Investors can check licensed operators via www.sec.or.th and the SEC Check First application, and can check investor alerts through the SEC’s investor alert system.

Anyone with information about suspicious activity can report it to the SEC complaint and whistleblowing centre at 1207, the SEC Facebook page, or SEC Live Chat on the SEC website.

Bitkub says 2021 issue has no impact on customers

Following the SEC’s complaint, Bitkub Online issued a clarification on July 23, 2026, saying the matter involved events from May to October 2021, about five years ago, concerning the company’s reporting documents.

Bitkub stressed that all customer assets currently held by the company are safe and complete, and that the company strictly complies with the law in safeguarding and storing customer assets.

The company said the matter behind the complaint arose from an incident in early May 2021 and was not caused by fraudulent conduct by the named individuals.

According to Bitkub, some of those named in the complaint, who were responsible for disclosing the company’s information, decided not to disclose that one of the company’s digital asset wallets had been stolen by cybercriminals.

Bitkub said that at the time of the incident, in early May 2021, the security systems for all of the company’s digital asset wallets complied with the standards set by relevant agencies and had passed inspections by those agencies.

The company said the decision not to disclose the information was made to prevent a bank run, meaning a situation in which customers, after learning of the theft, could simultaneously request large withdrawals of digital assets from the company.

Bitkub said this could have prevented the company from finding enough digital assets to fully replace customer assets while it was still resolving the issue. If a bank run had occurred, customers could have suffered widespread damage and Thailand’s digital asset industry could also have been affected, the company said.

Bitkub said that because no bank run occurred, even though the stolen digital assets have not yet been recovered, the co-founders of the Bitkub group stepped in to absorb the loss. They purchased digital assets for the company to replace the stolen assets in the same currencies and quantities as those stolen.

As a result, Bitkub said neither the company nor its customers suffered any damage from the incident.

Bitkub added that the SEC had already checked that, as of September 8, 2025, customer assets held by the company were safe and complete.

The company said the incident demonstrated that people connected to Bitkub were committed to protecting customer interests honestly and in good faith, rather than prioritising personal benefit.

Bitkub noted that cyber theft of this type has occurred around the world and not only to the company. It said that, like leading digital asset operators in other countries, Bitkub has continuously improved its security systems and internal processes.

The company said it gives the highest priority to security and has received the following recognition and certifications:

• Bitkub’s platform has been ranked by the cybersecurity rating website Cer.Live among the world’s top 20 cryptocurrency exchanges for security.
• The company has received international certifications including ISO 27001, ISO 27701 and SOC 2 Type I.
• Its systems comply with the NIST Cybersecurity Framework.
• Bitkub has introduced security features for customers, including Passkey technology and an advanced Self-Freeze function.
• The company undergoes annual security inspections by the SEC.
• It cooperates with global digital asset custodians, including BitGo Trust Company, Inc. and Coinbase Custody Trust Company, LLC, to safeguard customer digital assets.

Bitkub said the public can transparently verify the digital assets it holds for customers through the company’s financial statements available via its support website.

The company also said it is currently financially and operationally stable, and will continue developing all areas of its business.

Bitkub added that it now has independent directors who are external professionals with the required legal qualifications, knowledge and expertise. They oversee the company’s business operations, while Bitkub also has complete compliance and internal audit systems.

The company said this reflects its commitment to legal compliance and transparency as the core principles of its business.

Bitkub said it had already filed a complaint with investigators on May 10, 2021, seeking action against those who committed the digital asset theft and any other parties involved. The company said it would pursue legal action against those individuals to the fullest extent.

Bitkub also asked the public to refrain from publishing or providing information that could cause misunderstanding about the company’s financial position, operations, customer asset custody or other business matters.

Otherwise, the company said it may need to consider strict legal action.