Security

Thailand SEC Charges Bitkub Over 5-Year Cover-Up of $47 Million Hack

2026-07-27

Thailand's Securities and Exchange Commission filed a criminal complaint against Bitkub Online and two former directors on July 23, 2026, over the exchange's handling of a May 2021 hack. The alleged crime: burying a $47 million theft in regulatory filings for five months.

Hackers made off with 16 different cryptocurrencies worth 1.7 billion baht. Rather than disclose the breach to regulators straightaway, Bitkub kept quiet. The exchange's daily net liquid capital reports filed between May 10 and October 30, 2021, did not reflect the missing assets. Only after October 31, when the company had replaced the stolen coins with its own money, did the truth surface. The SEC's complaint alleges that Bitkub and directors Sakolkorn Sakavee and Thaweesap Rawan violated Thailand's digital asset regulations by submitting false information during those six months.

The legal charges are specific. Bitkub faces accusations under Section 76 of the Emergency Decree on Digital Asset Businesses—providing false information to the regulator. The two former directors are accused under Section 94 for their role in submitting the reports, and under Section 88(2) for making false statements in company documents. The SEC lodged the complaint with the Economic Crime Suppression Division.

Bitkub's defence rests on a different story. The company claims the delay was tactical, not criminal: delaying disclosure prevented panic withdrawals that could have spiralled into a genuine bank run. Founder Sakolkorn Sakavee released a video statement accepting sole responsibility. He said he altered and signed the regulatory filings himself, that no other director or employee knew what he was doing, and that he used his own money to cover losses so customers suffered nothing in the end. The hack, he framed as a crisis he managed alone to prevent a wider disaster.

The crux of the dispute isn't really about whether customers were harmed—both the SEC and Bitkub agree they weren't. The SEC's own inspection of Bitkub in September 2025 found digital assets fully accounted for. The question is whether a private company can unilaterally decide to hide a major security breach from its regulator in the name of damage control. The SEC says no. Regulators need to know, or the entire licensing framework becomes theatre.

The timing wounds Bitkub. The company is currently evaluating an IPO, eyeing a potential Hong Kong listing. A criminal complaint doesn't help those prospects. Neither does the company's diminished market position: Bitkub once commanded over 90% of Thailand's crypto trading volume. That figure has reportedly fallen to roughly half or less.

The case will now move through Thailand's criminal investigation process. Prosecution and any court proceedings remain ahead. Whether this ends in fines, asset restrictions, licence revocation, or something sharper depends on the investigation's findings and the courts' interpretation of what "false disclosure" actually means in this context.

Source & further reading:

Sources