The Securities and Exchange Commission (SEC) has filed a criminal complaint against Bitkub Online Co and two of its former directors, alleging they submitted false information to the regulator to conceal a cyberattack that resulted in the theft of digital assets worth about 1.7 billion baht.
In a statement released on Thursday, the SEC said it lodged the complaint with the Economic Crime Suppression Division (ECD), accusing Bitkub of violating Section 76 of the Emergency Decree on Digital Asset Businesses by providing false information to the regulator.
The SEC also named former directors Sakolkorn Sakavee and Thaweesap Rawan, alleging they are liable under Section 94 of the decree as the individuals responsible for submitting the reports. The pair were also accused of making false statements in company documents to deceive the SEC, an offence under Section 88(2) of the same law.
According to the SEC’s investigation, Bitkub was the victim of a cyberattack in May 2021, during which hackers stole 16 types of digital assets from the exchange. The breach resulted in the loss of customers’ digital assets valued at about 1.7 billion baht.
The SEC said Bitkub later fully replaced the stolen assets by Oct 31, 2021.
However, the regulator found that Bitkub failed to disclose the incident accurately in its daily net liquid capital report (Form Dor Jor 1). Reports submitted between May 10 and Oct 30, 2021 did not reflect any significant reduction in the company’s assets resulting from the theft, despite the cyberattack having occurred.
The omission amounted to submission of false information in violation of Section 76, according to the commission.
At the time of the incident, Mr Sakolkorn and Mr Thaweesap were responsible for filing the Dor Jor 1 reports on behalf of Bitkub and are therefore subject to the same legal liability as the company under Section 94 in conjunction with Section 76, the SEC said.
The regulator further alleged the two former directors knowingly entered false information to mislead the SEC into believing customers’ assets remained secure and that Bitkub had suffered no losses from the cyberattack. Such conduct may constitute the offence of making false statements in corporate documents to deceive another person under Section 88(2).
The SEC has filed criminal complaints against three parties: Bitkub, Mr Sakolkorn and Mr Thaweesap. The case will proceed through the criminal justice process, beginning with a police investigation, followed by consideration by public prosecutors and adjudication by the courts.
The SEC said it will closely monitor the case and continue to cooperate with relevant agencies to support enforcement of the Digital Asset Businesses Emergency Decree. It also urged the public and investors to exercise caution when using digital asset service providers that are not licensed by the SEC, warning that customers of unlicensed operators are not protected under Thai law and may face heightened risks of fraud and money laundering.
Investors can verify licensed digital asset operators through the SEC’s website, www.sec.or.th, or the SEC Check First mobile application. Information on entities not under SEC supervision is available through the regulator’s Investor Alert database.
The SEC also encouraged the public to report suspicious activities via its complaints and whistleblowing centre by calling 1207, via the SEC’s official Facebook page, or through SEC Live Chat on the regulator’s website.