Verified Platforms
Quick Links
Where to Stay Secure
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.
An exchange can pass an honest solvency check on every single day of a cover-up. On 27 July 2026 Thailand's SEC filed a criminal complaint against Bitkub and two of its former directors. The subject is an attack in May 2021 that took 16 types of digital assets, worth roughly 1.7 billion baht, or somewhere between $47 million and $50 million depending on where you read it. The theft is not the strange part. The co-founders bought the assets back with their own money, the hole was closed by the end of that October, and no customer was ever short a coin.
Five years later the case is criminal anyway. The charge is not theft and not insolvency. It is filing false reports.
So when you ask how do I know if a crypto exchange is solvent, it helps to know what the question can physically reach. Solvency is a comparison between two numbers at one moment. It answers whether the assets are there now. It has no way to tell you they left and came back, or who paid to put them back.
Ava is the structural reader on the Kodex faculty, the one who treats a balance sheet the way an engineer treats a load-bearing wall. Lucia is across the desk with the question you are probably already forming, and she is not letting it go. Ava will not open the Bitkub file until the mechanics are settled, because the mechanics are what the case breaks.
Ava starts by drawing a single dot.
"That dot is a reserve attestation," she says. "Assets on one side, liabilities on the other, both measured at the same instant. If the first number covers the second, the check passes."
Lucia waits for the rest. There is no rest.
"That is the whole instrument," Ava says. "It is a point. A point has a position and nothing else. It carries no direction, no speed, no record of where it has been."
The word attestation does a lot of quiet work here. It is a statement about a condition at a moment, and its accuracy is a separate question from its usefulness. A reserve report can be perfectly accurate and still be nearly silent about the thing you actually want to know. What Kodex has already covered on the stablecoin side is what an attestation can and cannot prove about a stablecoin's reserves, where the object being measured is a token's backing. Here the object is a venue's custody of your balance, and the blind spot sits in a different place.
Lucia pushes on the obvious thing. "Then make it continuous. Check it every second."
"Do that," Ava says, "and you have a lot of dots."
A sequence of passing checks tells you the level held. It still does not tell you what produced the level on any given day. That distinction sounds academic until money moves through it.
Picture two exchanges. Both publish the same total this morning, both cover customer liabilities with room to spare, both would pass any ratio you can design.
At the first one, nothing has happened in three years. The coins sat where they were deposited.
At the second, an attacker emptied a wallet in the spring, and the founders spent their own money buying the missing assets back on the open market until the total matched again.
"Same dot," Ava says. "Same balance, same pass, same green tick on the page."
Lucia leans back. "So what exactly was I checking?"
That is the correct question, and the answer is narrower than the page implies. You were checking existence. The assets are there. You were not checking continuity, because a level has no derivative: it does not record its own rate of change. Every reserve total is compatible with a boring history and with a violent one that was repaired before you looked.
There is a further step Lucia has not taken yet, and Ava waits for her to reach it. She runs back through the two exchanges, checks the arithmetic again, and then stops on something sitting upstream of all of it.
"Who measured the dot?"
Usually the venue did. A reserve report is a statement an exchange publishes about itself, sometimes with an outside firm checking the arithmetic, rarely with an independent party controlling the wallets or choosing the moment. That does not make it worthless, and it is not an accusation. It means the instrument and the subject are the same entity, so the output stays accurate exactly as long as the input does, including on the day the input becomes inconvenient.
Every well-documented weakness in reserve reporting is a weakness of accuracy: assets borrowed for the test, liabilities understated, a snapshot taken on a flattering afternoon. Those failures are real and they have emptied accounts. They also share one assumption, which is that the danger is a number that lies.
Bitkub is the other case. It is what happens when the number tells the truth.
There is a second thing the total cannot express, and it is the one that decides how much the first thing matters.
"Give me a wallet with a thousand coins in it," Ava says. "Tell me which ones belong to customers."
Lucia starts to answer and stops.
Nothing on-chain distinguishes owner equity from customer deposits. A coin bought this morning by a founder to plug a hole and a coin deposited last year by a customer are the same coin, in the same wallet, in the same total. The reserve report sums them. It has no field for provenance.
This is why "fully backed" is a weaker statement than it sounds. It says the pot is deep enough. It says nothing about who filled it, when, or in response to what. A venue quietly recapitalised by its owners after a loss and a venue that has never had a loss produce identical reserve pages. The difference between them is the thing you would most want to price.
The adjacent distinction Kodex has written about is what happens when your USDT can be frozen, where the asset exists but access to it does not. This is the mirror image. Access is fine, existence is fine, and what you are missing is the event.
Now the case.
A licensed digital asset business in Thailand files a daily net capital report, the Form DA 1. Bitkub's filings, the SEC alleges, showed no significant change in the exchange's holdings from 10 May to 30 October 2021. The attack had already happened. According to CoinDesk, the regulator says Bitkub and two former directors, Sakolkorn Sakavee and Thaweesap Rawan, made false statements in company documents to deceive it.
Sakolkorn has said he altered the filings himself, without telling other directors or staff, and that he stayed quiet fearing panic withdrawals and a bank run that could have ended the exchange. As Decrypt reported, the co-founders then purchased replacement assets in equivalent amounts, leaving neither Bitkub nor its customers out of pocket.
Read the dates closely, because the mechanism splits into two halves there.
Between 10 May and 30 October, the hole was open and the reports said otherwise. That period is a straightforward reporting failure, and it worked because the number was self-reported. The regulator was not independently measuring Bitkub's wallets. It was reading a form that one director was filling in.
From 31 October 2021, the replacement assets were in place. And from that date forward, the picture changes completely. The level was real. The coins existed. An independent, real-time, cryptographically proven reserve check run on 1 November 2021 would have passed, truthfully, with nothing hidden inside the arithmetic.
The attack would still have stayed invisible for five years.
"That is the part worth sitting with," Ava says. "Not that the check was gamed. That a perfect check would have said the right thing and told you nothing."
Lucia has the objection ready. "Then the whole exercise is theatre."
Not theatre. Load-bearing, just for a narrower load than the marketing suggests. A reserve page is the right instrument for one failure mode: the venue does not have the assets it claims. That failure mode is common, and it is how a customer discovers their balance was only ever a promise. It is not the only way a venue can be dangerous to you, and a five-month cover-up that ends with every customer repaid is the proof.
This is where the answer actually lives, and it is a rule, not a ratio.
Thailand's complaint cites Section 76 and Section 94 of the Emergency Decree on Digital Asset Businesses B.E. 2561, alongside Section 88(2) covering false entries in documents. Nation Thailand reported that the complaint names three parties, Bitkub Online Co Ltd and the two former directors, and has been referred to the Economic Crime Suppression Division for the police and prosecutors to take forward.
Strip the section numbers away and the shape is simple. A licensed venue owes its regulator an accurate account of its own condition, continuously, in a specified form. That duty is what makes concealment a crime rather than a business decision. It is also the only mechanism in the entire structure that is pointed at events instead of levels.
Ava sets the two instruments side by side. "Ask what each one is capable of recording," she says. "Not which one is more trustworthy."
| What the reserve page records | What only a disclosure duty records |
|---|---|
| The balance on the day it was checked | That the balance moved, and when |
| That assets currently cover liabilities | Who supplied the assets that cover them |
| A total the venue publishes about itself | An event the venue would rather not publish |
The right-hand column is what would have reached a Bitkub customer in 2021, and nothing in the left-hand column can produce it. These are not two levels of rigour applied to the same measurement. They are different measurements, and only one of them has a time axis.
Lucia is still not satisfied, and her objection is the sharpest one in the piece. "He said he kept it quiet to stop a bank run. If that was true, was he wrong?"
He may well have been right about the run. That is exactly why the rule cannot be left to the venue. Every exchange that ever takes a loss has the same incentive, in the same direction, permanently: silence protects the balance sheet, and disclosure risks the queue at the door. A duty is not there to catch dishonest operators who lack good reasons. It is there because the good reason is always available.
Which regime a venue sits under therefore decides what you are owed. That is the argument behind the rulebook a venue operates under rather than the app it hands you. The Brazilian version of the question, what authorisation and segregation require of a local exchange, lands in the same place. The interface looks the same in every jurisdiction. The obligations behind it do not.
Set Bitkub next to Bybit and the variable isolates itself.
On 21 February 2025 Bybit lost roughly $1.5 billion in an attack on an Ethereum cold wallet, the largest exchange theft on record. Its chief executive posted about it publicly the same day, while it was still unfolding. All withdrawals were processed inside twelve hours. By 24 February the exchange said its reserves were replenished, having sourced around 447,000 ETH through emergency funding from firms including Galaxy Digital, FalconX and Wintermute.
End state: reserves whole, customers repaid, owners and partners covering a loss they did not cause. That is the same end state Bitkub reached.
The difference is that a Bybit customer knew within hours and could act on it. Withdraw, stay, hedge, reduce, or do nothing on purpose rather than by accident. A Bitkub customer in 2021 held a position whose venue had just lost a chunk of its assets and had no way to reach that fact.
"Both exchanges ended up solvent," Ava says. "Only one of them ended up legible."
Which venue is safest is the wrong shape of question. Safety sits in the regime a venue operates under, not in a score you can put on the venue itself.
You can look up which authority the venue answers to, and whether that authority comes with a licence number you can check rather than a jurisdiction mentioned in a footer. The harder question is what that regime requires the venue to report when something goes wrong: not whether it publishes reserves, but whether an incident must be disclosed, to whom, and on what clock. A venue can publish a live reserve feed and owe no one an account of a breach. Those are separate systems.
The "to whom" carries more weight than it looks. Bitkub's duty ran to its regulator, in a daily form. The customer was never the recipient. That structure can still work, because a regulator reading an accurate filing can act on your behalf faster than you could. It also puts an extra link in the chain from event to customer. The Thai complaint alleges that link was cut at the first joint, by the person filling in the form. Where a regime requires public disclosure too, the venue has to say it out loud, and that difference shows up on the day it matters.
Past behaviour is the closest thing to a preview of that day. An exchange that has published its own incident reports, including ones that made it look bad, has demonstrated the behaviour under conditions where silence was cheaper. That record is worth more than any current-day ratio, because it is the only evidence you will ever get about what the venue does on the day the number would have been embarrassing.
And when you do read the reserve page, read it for what it is. The balance is real. That is a real thing to know, and it rules out a real category of disaster.
"It tells you the money is there," Ava says. "It does not tell you what it has been through."
Lucia writes that down. It is the sentence she came in wanting, and it is smaller than she expected, which is usually the sign it is the true one.
Pick the exchange you already use and find out what it is required to disclose when it gets hit. Write the answer down. Then open a position in the Kodex simulator on its $5,000 practice balance and hold it through the next bad headline, so the habit of asking what a venue owes you is built while the position is still simulated.
