- Trending
- Comments
- Latest
South Korea’s National Tax Service lost approximately $4.8 million in seized cryptocurrency after officials published a press release photograph that clearly showed the handwritten recovery phrase for a confiscated hardware wallet. Within hours, an unknown party used the exposed phrase to drain the wallet entirely.
In accompanying photographs, officials inadvertently revealed an unredacted mnemonic recovery phrase tied to a seized cryptocurrency wallet — a disclosure that experts say made the loss all but inevitable.
Within hours of the NTS crypto seed phrase leak, unknown actors accessed the wallet and transferred out 4 million Pre-Retogeum (PRTG) tokens, according to blockchain data reviewed by researchers. The tokens were valued at approximately 6.4 billion won, or around $4.8 million, at the time of the transfers.
The controversy centers on images distributed by the NTS to showcase its enforcement performance. Among the photos was a hardware wallet — a Ledger cold wallet device — seized from a delinquent taxpayer identified as “Mr. C.” Next to the device lay a handwritten sheet containing the wallet’s mnemonic phrase, fully visible and without any redaction.
In cryptocurrency systems, a mnemonic phrase functions as the master recovery key. Anyone who possesses the 12- to 24-word sequence can restore the wallet on another device and move its assets without further authentication.
According to Professor Cho Jae-woo, director of the Blockchain Research Institute at Hansung University, blockchain records show that shortly after the NTS crypto seed phrase leak, the wallet’s contents were systematically drained.
On-chain data from Etherscan indicates that an unknown party first deposited a small amount of Ethereum to cover transaction fees, then transferred the 4 million PRTG tokens out in three separate transactions.
“If they seized virtual assets, they would disclose the most important mnemonic in a press release that the entire nation can see,” — Cho Jae-woo, Director, Blockchain Research Institute, Hansung University. “This is like advertising to open your wallet and take your money.”
The National Tax Service had not issued a formal explanation regarding the NTS crypto seed phrase leak at the time of publication.
Security specialists describe the NTS crypto seed phrase leak as a failure of basic digital asset management principles. In the cryptocurrency ecosystem, mnemonic phrases are treated as highly sensitive credentials — comparable to a bank certificate, password, and security card combined.
Professor Hwang Seok-jin of Dongguk University said photographing or digitally storing such information is fundamentally unsafe.
“Taking a picture of a mnemonic code and storing it in a gallery, messenger, or cloud is something you should never do,” — Hwang Seok-jin, Professor, Dongguk University.
“Just like taking a picture of a bank security card in the past and storing it on a computer, taking a picture of (the mnemonic) and posting it on the web is essentially the same as saying, ‘Take it all.’”
Professor Hwang added that mnemonics should be recorded on physical media such as paper or metal plates and kept strictly offline. The exposure in an official press release, experts say, directly enabled the theft.
The NTS crypto seed phrase leak has therefore been described by industry observers as a foreseeable outcome of insufficient operational controls. Once the phrase was made public, any technically capable individual could restore the wallet remotely and initiate transfers.
The NTS crypto seed phrase leak is the latest in a series of digital asset custody incidents involving South Korean public institutions.
In January, the Gwangju District Prosecutors’ Office reported losing 320.8 bitcoin — valued at more than $21 million at current prices — after a staff member accessed a phishing website during a wallet verification process.
Those funds, originally confiscated from individuals convicted of laundering gambling proceeds, were intended for transfer to the national treasury. Authorities later recovered the bitcoin on February 17 after freezing exchange accounts, which officials believe prompted the hacker to return the funds voluntarily.
Earlier this month, Seoul’s Gangnam Police Station disclosed that 22 bitcoin worth over $1.4 million had gone missing. The loss was uncovered during a nationwide audit initiated after the Gwangju case. Officers had failed to transfer the seized assets into a government-controlled cold wallet and did not retain the seed phrase necessary for access. Two suspects have since been arrested in connection with that case.
These repeated lapses come shortly after the ruled in January 2026 that bitcoin qualifies as property subject to seizure under criminal law, formally broadening state authority to confiscate digital assets.
The ruling was widely viewed as a milestone in aligning digital assets with existing enforcement frameworks. However, the NTS crypto seed phrase leak and related incidents suggest that operational readiness has not kept pace with expanding legal powers.
As South Korea moves to refine oversight of the crypto sector, including plans to strengthen regulation of digital assets and stablecoins, experts say improved custody standards within public institutions will be critical.
For now, the NTS crypto seed phrase leak stands as a cautionary case study in how a single lapse in handling sensitive recovery information can translate into multimillion-dollar losses — and renewed scrutiny over the government’s capacity to safeguard seized digital wealth.
Copyright © 2025 - The Bit Gazette.
