The SEC's case, submitted to the Economic Crime Suppression Division, centers on a May 2021 cyberattack that drained 16 types of digital assets worth 1.7 billion baht from Bitkub's wallets. From May through October of that year, the exchange's daily net-capital disclosures showed no meaningful change in its holdings, according to the regulator. The complaint names former directors Sakolkorn Sakavee and Thaweesap Rawan, accusing them of making false entries to mask the missing customer funds.

Bitkub itself said the decision to stay silent came from the top. In a video posted to Facebook last week, Sakolkorn took sole responsibility, acknowledging that he altered the filings himself without informing fellow directors or staff. His reasoning: a public disclosure risked a bank run that could have destroyed the exchange entirely. He has since resigned from Bitkub's boards and said he will cooperate fully with authorities.

Where the criminal referral leads is now up to Thai police and prosecutors. The statute of limitations on the alleged violations is 10 years. Bitkub still has five.

• Thailand's SEC filed a criminal complaint against Bitkub and two former directors over undisclosed losses from a May 2021 hack

• Ex-director Sakolkorn Sakavee admitted altering filings himself to prevent a bank run and has since resigned