Bitkub

Is Bitkub safe?

Bitkub is a licensed exchange with a serious governance problem. Thailand's SEC says that in May 2021 about 1.7 billion baht (about $47 million) of digital assets was stolen from Bitkub, and that for the next five months its daily reports to the regulator showed nothing wrong. The public learned of the theft only in July 2026, when the SEC filed a criminal complaint. Bitkub says its co-founders quietly replaced every coin and no customer lost money, and we found no report that contradicts that.

We score it 50/100. That is below Indodax (57), another licensed regional leader that disclosed its 2024 hack at once, and below Upbit (68). It is above CoinEx (45), one of the unlicensed platforms Thailand blocked in 2025.

What happened in 2021, and why it matters now

According to the SEC, attackers took 16 types of digital assets from Bitkub in May 2021. Licensed Thai exchanges must file a daily net-capital report (form DA 1). The SEC says Bitkub Online's reports from 10 May to 30 October 2021 showed no significant change in assets, so the regulator was led to believe customer assets were intact.

On 23 July 2026 the SEC filed a complaint with the Economic Crime Suppression Division against Bitkub Online Co., Ltd. and two former directors, Sakolkorn Sakavee and Thaweesap Rawan, under section 76 of the 2018 Digital Asset Business Decree. The directors also face an allegation of falsifying company records. The case now goes to police and prosecutors; nobody has been convicted.

Bitkub's account is that the people responsible chose not to disclose the wallet theft to avoid a bank run, and that its co-founders bought back the same coins in the same amounts, completing the replacement by 31 October 2021. Sakolkorn reportedly said in a video statement that he altered the filings himself without telling other directors, apologised and resigned from the company's boards.

For a customer, two things follow. If Bitkub's account is right, nobody was left short. But a licensed exchange hid a large loss from its regulator for five years, which is exactly the failure that proof of reservesProof of reservesA report in which a crypto exchange shows that it holds enough coins to cover all customer balances, ideally checked by an outside firm.More in the glossary and daily reporting are meant to catch.

An earlier record with the SEC

This is not Bitkub's first clash with the regulator. In June 2022 the SEC found that Bitkub Online and its then chief executive had created artificial trading volume on the exchange, and set fines of about 24 million baht for the company and two individuals. In September 2022 the SEC asked prosecutors to take the case to court, seeking about 24.2 million baht in fines and costs. In August 2022 the SEC fined Bitkub's chief technology officer about 8.5 million baht for buying the exchange's own KUB token using inside knowledge of Siam Commercial Bank's planned purchase of 51% of Bitkub, a deal the bank's parent SCBX dropped that month.

Commentators in Thailand have also asked why the audited accounts did not show the 2021 loss and why the group's major shareholder was not named in the complaint. Those are questions, not findings, and we do not score them.

Licence and customer protection

Bitkub Online is licensed by Thailand's SEC as a digital asset exchange. Licensed exchanges must keep customer assets separate from their own, report them daily and submit audited accounts, and the SEC actively polices the market: in 2025 it had five unlicensed foreign platforms, including CoinEx and Bybit, blocked in Thailand.

The licence is real protection, and it is why Bitkub scores higher on licensing and custody than offshore exchanges. But the 2021 case shows its limits: reporting rules work only if the reports are honest. Bitkub says the SEC checked customer assets on 8 September 2025 and found them intact. We could not open Bitkub's proof-of-reservesProof of reservesA report in which a crypto exchange shows that it holds enough coins to cover all customer balances, ideally checked by an outside firm.More in the glossary page, which blocks automated access, so we have not checked what it covers. Crypto held on any Thai exchange is not covered by deposit insuranceDeposit insuranceA government-backed scheme that repays bank customers up to a set limit if their bank fails, such as the FDIC in the US or the FSCS in the UK.More in the glossary.

How to use Bitkub more safely

1. Keep only what you trade on the exchange, and move long-term holdings to a wallet you control. Test with a small amount first.
2. Turn on app-based two-factor authenticationTwo-factor authenticationSigning in with a second proof of identity on top of your password, such as a code from an app, a security key or a passkey.More in the glossary and the withdrawal address allowlist.
3. Use only SEC-licensed exchanges if you are in Thailand. Unlicensed platforms leave you without protection under Thai law.
4. Follow the criminal case. A charge or a finding that customer assets were short would be a reason to withdraw.
5. Keep your own records of deposits and balances. If an exchange's reports cannot be trusted, your statements are your evidence.

How we scored it

Legal record (30) is Bitkub's weakest factor, because of the 2026 criminal complaint and the 2022 fines. Licensing (55) and custody (55) reflect a real Thai licence with segregation rules that failed to surface the 2021 loss. Security history (55) credits Bitkub's claim that the stolen coins were replaced but marks down five years of concealment. Confidence is medium: the case details come from reports of the SEC's complaint rather than the SEC's own release, and Bitkub's site blocked us.