South Korea's tax office lost millions in crypto after accidentally posting the wallet's master key
South Korea keeps losing confiscated crypto – and each new case is more embarrassing than the last. Just a month ago, the National Police Agency discovered that 22 Bitcoin seized from suspects had gone missing years prior because officials never bothered transferring the funds to a state-owned wallet. Now the National Tax Service (NTS) made an even worse mistake – effectively handing cybercriminals the keys to confiscated digital assets.
It all happened during a PR push meant to highlight the agency's progress against online fraud and cybercrime. According to local reports, Seoul's NTS released a press statement about a large-scale investigation targeting 124 suspects in high-profile tax fraud cases. Alongside the text, the agency published a photo that revealed far more than anyone intended.
The image showed four USB drives containing crypto wallets, stacks of cash, and a sheet of paper with a mnemonic seed phrase – the recovery key used to restore access to a wallet. The total value of the seized digital tokens came to 8.1 billion won (roughly $8.2 million).
A mnemonic phrase is essentially a master key to a crypto wallet. Anyone who has it can fully restore access to the funds without ever touching the original hardware. That's exactly what happened – an unidentified party used the exposed phrase to move 4 million PRTG (Pre-Retogeum) tokens into their own wallets, draining approximately $4.8 million (6.4 billion won) from the NTS.
Blockchain analyst Jae-woo Cho said the perpetrators appeared to know precisely what they were doing. They first sent a small amount of ETH to the compromised wallet to cover transaction fees, then moved the 4 million PRTG tokens out across three separate transfers.
Cho argued the incident reflects a fundamental lack of understanding within South Korea's tax authorities about how digital assets actually work. Dongguk University professor Hwang Seok-jin put it bluntly: publishing a seed phrase in a press release is the equivalent of photographing and posting your full bank login credentials online.
In effect, the NTS invited the internet to help itself to the seized funds – and someone took them up on it. Though it's worth asking whether this was truly an accident, or whether someone with advance knowledge of the publication was waiting to act.
