Thailand’s Securities and Exchange Commission has filed a criminal complaint against cryptocurrency exchange Bitkub Online Co., Ltd. and two of its former directors, alleging they submitted false statements and misleading corporate documents related to a major cyberattack that occurred in 2021.
The complaint, filed with the Economic Crime Suppression Division, marks the latest enforcement action tied to one of Thailand’s largest cryptocurrency security incidents. Authorities allege the company failed to accurately disclose the financial impact of the attack in regulatory filings, while the former executives allegedly approved or submitted misleading information to regulators.
Allegations Linked to 2021 Cyberattack
According to the SEC, Bitkub suffered a cyberattack in May 2021 that resulted in the theft of digital assets across 16 cryptocurrencies with an estimated value of about 1.7 billion baht. Regulators claim the exchange continued filing daily net capital reports between May 10 and October 30, 2021, without reflecting the material reduction in assets caused by the theft.
The SEC alleges that:
- Bitkub submitted false statements in its required regulatory reports.
- Two former directors were responsible for filing the reports during the relevant period.
- The former executives also made false entries in company documents intended to mislead regulators into believing customer assets remained unaffected and no damage had occurred.
The regulator said these actions may violate provisions of Thailand’s Emergency Decree on Digital Asset Businesses, prompting the criminal complaint and the launch of a formal investigation.
Bitkub Responds
Following the SEC’s announcement, Bitkub stated that the case relates solely to reporting practices surrounding events that occurred between May and October 2021. The company emphasized that customer assets currently held on the platform remain safe and fully intact.
Bitkub also said the underlying incident was not the result of fraudulent conduct by the individuals named in the complaint. According to the exchange, the matter concerns historical disclosure decisions made after the cyberattack rather than the security of customer funds today.
The criminal complaint does not constitute a conviction. Under Thailand’s legal process, investigators will review the allegations before prosecutors determine whether to pursue formal charges, with any final ruling resting with the courts.
