The Alleged Cover-Up and Hack
Published 7/27/2026, 7:37:59 PM
The Thai Securities and Exchange Commission (SEC) has initiated a significant criminal enforcement action against Bitkub Online Co., Ltd., the country's dominant cryptocurrency exchange, following allegations of a multi-year cover-up regarding a 2021 cyberattack. On July 23, 2026, the SEC filed a criminal complaint with the Economic Crime Suppression Division (ECD) against the exchange and two former directors, Sakolkorn Sakavee and Thaweesap Rawan.
This move signals a shift toward "zero tolerance" for reporting failures, potentially triggering a broader regulatory crackdown on Thai exchanges through stricter executive liability and mandatory real-time disclosure requirements.
The Alleged Cover-Up and Hack
The core of the regulatory action stems from a May 10, 2021 security breach where 16 types of digital assets, valued at approximately 1.7 billion baht (~$50 million USD), were stolen. The SEC alleges that Bitkub intentionally concealed this loss for nearly five years by filing false daily net liquid capital reports (Form DA 1) between May and October 2021. These reports allegedly created a "false impression" that customer assets were intact and the exchange had suffered no damage.
Bitkub's Defense and Current Status
Bitkub maintains that the non-disclosure was a strategic decision to prevent a "bank run" while co-founders personally purchased replacement assets to make customers whole.
- Asset Replacement: By October 31, 2021, all stolen assets were reportedly replaced.
- Safety Confirmation: The SEC confirmed in September 2025 that customer assets were safe.
- Current Security: Bitkub highlights its current security certifications (ISO 27001, SOC 2 Type I) and custody partnerships with BitGo and Coinbase to argue that the case is a dispute over historical disclosure timing rather than ongoing fraud.
Regulatory Crackdown and Market Impact
The incident has triggered a tightening of the Thai regulatory environment, characterized by:
- Criminal vs. Civil Enforcement: The shift to criminal charges under Sections 76, 88(2), and 94 of the Digital Asset Decree signals that reporting failures will no longer be handled solely with fines.
- Executive Liability: The targeting of individual directors sets a precedent for personal accountability in cybersecurity failures.
- IPO Risks: The allegations have cast a shadow over Bitkub's plans for a 2026 IPO in Hong Kong, which was targeting a raise of approximately $200 million USD.
- New 2026 Framework: While cracking down on misconduct, the Thai SEC is simultaneously expanding regulated access through new guidelines for Crypto ETFs and Futures trading on the Thailand Futures Exchange (TFEX) expected in early 2026.
| Metric | Detail |
|---|---|
| Stolen Amount | 1.7 Billion Baht (~$50M USD) |
| Concealment Period | May 2021 – July 2026 (~5 years) |
| Market Share | 90%+ of Thai Crypto Market [Note: not independently confirmed] |
| Legal Charges | Sections 76, 88(2), and 94 of Digital Asset Decree |
| Proposed IPO Raise | ~$200 Million USD (Hong Kong, 2026) |
Broader Implications for Thai Exchanges
While the current enforcement is Bitkub-specific, the SEC's aggressive stance suggests that other Thai exchanges (such as Orbix or InnovestX) may face:
- Audit Intensification: Increased frequency of spot checks on net liquid capital reports.
- Disclosure Mandates: New requirements for immediate public notification of security breaches, regardless of whether assets are replaced by the firm.
- Licensing Scrutiny: The SEC may use this precedent to tighten the criteria for license renewals in late 2026.
The outcome of the criminal complaint against Bitkub's directors will likely determine if the "preventing a bank run" defense is legally viable or if it constitutes criminal market manipulation.