Thailand SEC Files Criminal Complaint Against Bitkub Over $50M Hack Cover-Up

Thailand's Securities and Exchange Commission filed a criminal complaint today against Bitkub, the country's largest cryptocurrency exchange, and two of its former directors, alleging the firm concealed a $50 million cyberattack from regulators for years.

The complaint, filed July 24, 2026, centers on false disclosures tied to a 2021 breach. According to the Thailand SEC, Bitkub failed to report the incident to oversight authorities as required, potentially obstructing regulatory supervision during a period when the exchange held a dominant position in the Thai crypto market. The charges go beyond civil penalties, marking a deliberate escalation to criminal liability for material non-disclosure.

This is not a fine. It is a criminal referral, a distinction that carries serious personal consequences for the two named former directors.

Bitkub has not yet issued a formal public response to the complaint as of this writing. The exchange's defense team may argue that Thailand's crypto disclosure framework was still taking shape in 2021, leaving incident reporting timelines ambiguous. There is also a plausible argument that the breach was ultimately contained and user funds were recovered, limiting concrete harm to customers. Whether those arguments hold weight in Thai criminal courts is a separate question from whether they hold regulatory merit.

The SEC's decision to pursue criminal charges rather than administrative sanctions signals a harder posture. Globally, regulators have increasingly moved in this direction when exchanges are found to have actively concealed security incidents rather than simply failing to comply with technical reporting windows. The distinction matters: negligent non-disclosure typically draws fines; deliberate concealment draws prosecutors.

Thailand has been tightening its grip on digital asset platforms since at least 2022, when the SEC introduced stricter licensing requirements and began auditing exchanges more aggressively following a wave of retail investor losses. Bitkub, which commands a significant share of Thai baht-denominated crypto volume, has operated under heightened scrutiny throughout that period. A criminal outcome against the exchange's former leadership would represent the most consequential enforcement action the Thai SEC has taken against a domestic crypto firm to date.

Exchanges that delayed breach disclosures have faced regulatory consequences ranging from settlement agreements to operating restrictions. Thailand's move to criminalize the conduct rather than settle it administratively puts the country's enforcement posture closer to the aggressive end of the spectrum, more aligned with how U.S. and EU regulators have approached fraud-adjacent non-disclosure than with lighter-touch regimes common in parts of Southeast Asia.

For other exchanges operating in Thailand, the message is direct: incident disclosure is not optional, and the window for voluntary remediation may be shorter than previously assumed. Regional platforms watching this case will need to review their own breach notification policies against Thai SEC requirements, particularly for legacy incidents that may not have been fully reported under older frameworks.

The case now moves to Thai prosecutors, who will determine whether the evidence supports formal charges. If it proceeds, the trial would likely become a landmark test of how far Thailand's regulatory authority extends over historical conduct by crypto executives, and how seriously courts treat transparency obligations in the digital asset sector.