Thailand's SEC sends Bitkub hack disclosure case to prosecutors
The regulator alleges the exchange and two former directors misreported a 2021 theft; Bitkub says customers were made whole and the case concerns past disclosure decisions.
Thailand's Securities and Exchange Commission has sent a criminal complaint against Bitkub Online and two former directors to the country's Economic Crime Suppression Division. In its July 23 notice, the regulator alleged that the exchange gave false statements and that the former directors made false entries in company documents after a 2021 cyberattack.
The SEC said the May 2021 attack involved 16 cryptocurrencies and led to customer assets worth about 1.7 billion baht being withdrawn from the exchange. It said Bitkub later procured replacement assets from Oct. 31, 2021, but did not reflect the material change in its daily net-capital reports, known as Form DA 1, for the period from May 10 through Oct. 30.
Customer reimbursement and disclosure are separate questions
Bitkub's response says customer assets currently held by the exchange are safe and complete. The company said the loss came from one wallet, that the people responsible chose not to disclose the theft to avoid a bank run, and that the group's co-founders bought replacement assets for the company. The statement frames the decision as an attempt to protect customers from a wider withdrawal crisis.
That explanation addresses the balance-sheet outcome; it does not resolve the regulator's allegation about the reporting process. An exchange can replace stolen assets and still face a separate question about whether customers, supervisors and financial statements received accurate information while the loss was outstanding. The SEC's complaint is an allegation, not a conviction, and the regulator says the next stages are investigation, a prosecutor's review and adjudication in court.
The case tests the record around an incident
The case puts operational reporting at the center of an exchange-security event. Wallet controls and customer restitution determine whether assets can be recovered or replaced. Daily capital reporting determines whether supervisors can see the damage while it is happening. Those controls serve different purposes, and one cannot substitute for the other.
The next evidence will be the inquiry record, any decision by prosecutors and the court's treatment of the alleged Form DA 1 entries. For customers and counterparties, the practical questions are equally concrete: how an exchange escalates a theft, which assets back customer claims during the response, and how quickly the incident reaches regulators and the public. The complaint keeps those questions open while the legal process runs.
