Thailand's SEC accuses Bitkub of concealing a $53 million crypto theft in 2021, raising questions about exchange transparency and user asset safety as the investigation continues
Thailand's largest cryptocurrency exchange, Bitkub, is under criminal investigation after the country's Securities and Exchange Commission (SEC) alleged the company concealed a major theft of customer assets in 2021. The SEC claims Bitkub failed to disclose the loss of approximately 1.7 billion baht (about $53 million) in digital assets following a cyberattack, instead submitting daily net-capital reports that did not reflect the missing funds. The regulator's complaint, filed on July 23, 2026, names Bitkub Online and two former directors, Sakolkorn Sakavee and Thaweesap Rawan, as responsible parties for the alleged false reporting.
According to the SEC, the May 2021 incident involved unauthorized withdrawals of 16 different cryptocurrencies from a company wallet. Despite the scale of the theft, Bitkub's required Form DA 1 filings from May through October 2021 showed no material change in asset balances. The SEC alleges this omission was intended to prevent a loss of confidence and a potential run on the exchange. Bitkub reportedly began acquiring replacement digital assets only at the end of October 2021, but the regulator has not confirmed when the process was completed or whether all assets were fully restored at that time.
Exchange Response and User Impact
Bitkub has acknowledged that its disclosure team chose not to inform customers or regulators about the theft while the company worked to replace the stolen assets. The exchange maintains that this decision was made to avoid triggering a bank run and insists that its co-founders personally covered the loss by purchasing equivalent amounts of the affected cryptocurrencies. Bitkub claims that neither the company nor its customers ultimately suffered a loss, as all assets were replaced before any user withdrawals were affected. The company disputes allegations of fraud or intentional deception by the accused former directors.
The SEC's investigation focuses on whether Bitkub's reporting practices violated Thai securities law by failing to accurately reflect the company's financial position during the months following the theft. The regulator has emphasized that its September 2025 review found customer assets to be complete and safe as of that date, but this assessment does not resolve questions about Bitkub's conduct in 2021. The case remains open, with an inquiry official now tasked with determining whether to recommend prosecution. If the case proceeds, a public prosecutor and the courts will decide whether Bitkub and its former directors are liable for criminal violations.
Regulatory and Market Context
This case highlights the growing scrutiny of centralized crypto exchanges in Asia and globally, especially regarding transparency, asset custody, and regulatory compliance. For U.S. users and investors, the Bitkub investigation underscores the risks associated with holding assets on offshore exchanges, where disclosure standards and regulatory oversight may differ from those in the United States. While Bitkub is not widely used by U.S. residents, the incident adds to a pattern of high-profile exchange failures and cover-ups that have shaped global regulatory responses to digital asset platforms.
According to Thailand's SEC, the criminal complaint against Bitkub and its former directors is part of a broader effort to enforce accurate reporting and protect customer assets in the country's digital asset sector. The outcome of this case could influence future regulatory approaches in Thailand and potentially serve as a reference point for other jurisdictions considering stricter oversight of crypto exchanges.
Key Figures and Timeline
Bitkub's daily net-capital reports, known as Form DA 1, are required by Thai regulators to ensure exchanges maintain sufficient assets to cover customer balances. The SEC alleges that from May 10 to October 30, 2021, Bitkub's filings did not reflect the $53 million loss, despite the theft occurring in May. The company began replacing the stolen assets on October 31, 2021, but the SEC has not specified when the process was completed. In September 2025, the SEC confirmed that customer assets were intact as of September 8, 2025, but this review did not address the period immediately following the theft.
Bitkub's case is one of several recent incidents in Asia where regulators have taken action against exchanges for alleged failures in reporting, custody, or user protection. The outcome may affect how exchanges worldwide approach incident disclosure and regulatory compliance, especially as authorities in the U.S. and other countries increase their focus on digital asset market integrity.
As of July 2026, Bitkub remains under investigation, and no final determination has been made regarding criminal liability. The case serves as a reminder that exchange users face risks not only from external attacks but also from how platforms handle security incidents and communicate with regulators and customers.
In May 2021, Bitkub suffered a theft of approximately 1.7 billion baht (about $53 million) in digital assets, affecting 16 cryptocurrencies. The company's daily net-capital reports from May 10 to October 30, 2021, did not reflect the loss. Bitkub began replacing the stolen assets on October 31, 2021. As of September 8, 2025, Thailand's SEC confirmed that customer assets held by Bitkub were complete, but the investigation into the 2021 reporting remains ongoing.
Centralized exchanges like Bitkub are required by regulators to maintain accurate records of customer assets and report any material changes promptly. When exchanges fail to disclose losses or security incidents, users may be exposed to hidden risks, including the possibility of delayed withdrawals or unrecoverable funds. Regulatory oversight varies widely by jurisdiction, and users should be aware that protections available in one country may not apply elsewhere. The Bitkub case illustrates the importance of transparency and timely disclosure in maintaining trust in digital asset platforms.
