Thailand's SEC has turned Bitkub's hidden 2021 hack into a criminal complaint, and the exchange's own bank-run explanation doesn't help much. If daily capital reports can hide a 1.7 billion baht hole, they aren't oversight at all.
Bitkub didn't lose its customers' money in May 2021 and then tell the market what happened. It lost the assets, replaced them, and kept filing clean paperwork. For almost six months, from May 10 to October 30, 2021, Thailand's biggest crypto exchange submitted daily net capital reports to the Securities and Exchange Commission that showed no material change in assets, even though 16 types of digital assets worth about 1.7 billion baht had been stolen from its wallets. Now the silence has become the case.
On July 23, 2026, Thailand's SEC filed a criminal complaint with the Economic Crime Suppression Division against Bitkub Online Co. and two former directors, Sakolkorn Sakavee and Thaweesap Rawan. The regulator said the company gave false statements under Section 76 of the Emergency Decree on Digital Asset Businesses B.E. 2561, and said the two former directors were liable under Section 94. It also accused the former directors of making false entries in company documents under Section 88(2). That's not a small compliance slap.
The facts are unusually blunt because Bitkub has acknowledged the basic shape of the story. In a July 23 statement, the company said people responsible for disclosure decided not to reveal that one company wallet had been stolen because they feared a Bank Run, meaning customers rushing to withdraw assets while the company was still trying to replace what had gone missing. Bitkub said current customer assets are safe and complete, and that the incident was not caused by fraudulent conduct by the named individuals. That argument has limits.
The Form DA 1 problem is the case
The SEC's complaint rests on a simple paper trail. Licensed digital asset operators in Thailand submit daily net capital reports, known as Form DA 1, so the regulator can see whether an exchange's financial position has changed. According to the SEC's July 23 notice, Bitkub's Form DA 1 filings from May 10 to October 30, 2021 gave no indication that the theft had materially changed the company's asset balance.
That is the hard part for Bitkub. The co-founders' decision to buy replacement assets with their own money, as Bitkub described in its public statement and as Decrypt reported from Sakolkorn's video remarks, may explain why customers were eventually made whole. It doesn't explain why the regulator was given filings that, according to the SEC, made it look as if customers' assets were being held in the ordinary course and no damage had occurred.
The distinction matters. Customers can be protected from loss and regulators can still be deceived. If you run an exchange, those are not interchangeable duties. One is custody. The other is disclosure. The SEC's position is that Bitkub failed the second even if the first was repaired by October 31, 2021, when the regulator says the company had procured replacement assets.
Frankly, the bank-run defence is the weakest part of Bitkub's explanation. It asks you to accept that withholding a 1.7 billion baht theft was a customer-protection measure because disclosure itself might have caused panic. That is exactly why disclosure rules exist. A company in trouble always has a reason to delay bad news. The point of regulation is to stop that reason from becoming policy.
The IPO context makes the timing worse
The complaint lands while Bitkub has been weighing a public listing outside Thailand. The Block reported in November 2025, citing Bloomberg, that Bitkub was considering a Hong Kong IPO that could raise about $200 million as early as 2026 after earlier plans for a Thailand listing ran into a weak domestic market. Cointelegraph later reported Bitkub's response that no IPO decision had been finalized and that any listing discussion was still early and exploratory.
A criminal complaint against the company and two former directors is not the kind of disclosure a listing team wants to explain. Investors can live with old operational failures if the story is clean, the loss is bounded, and the remediation is documented. A hidden wallet theft followed by allegedly false regulatory reports is messier. It goes straight to governance.
Thailand's broader crypto policy is open enough on its face. The Finance Ministry moved to exempt capital gains from cryptocurrency and digital token sales through licensed digital asset operators from January 1, 2025 to December 31, 2029, according to HKTDC Research and Thai tax guidance. That makes the Bitkub case more interesting, not less. A friendlier tax regime doesn't mean regulators will tolerate bad reporting from licensed platforms.
There is also a market reason to watch this closely. CoinGecko's 2026 research still describes Bitkub as Thailand's biggest crypto exchange by 2022 trading volume, with a 75.4% share among the top four Thai centralized exchanges that year. When the dominant local exchange is accused of hiding a major theft, the issue isn't only Bitkub's reputation. It is whether licensed exchanges can persuade users that local regulation means something concrete.
The next step is slower. The SEC said the criminal process now moves through police investigation, public prosecution, and the courts, and that it will monitor the proceedings. It didn't give a timetable. Bitkub has asked the public to avoid circulating misleading information about its financial position or custody of customer assets. The more immediate question is already clear: if the daily reports didn't show the missing 1.7 billion baht, what exactly were they worth?
Also read: Coinbase opens instant trading on millions of Solana and Base tokens without issuer approval • Brian Armstrong tells crypto founders who pivoted to AI they got it backwards • Bitcoin's BIP-110 Fork Deadline Is Days Away and Almost No One Is Signaling Support
