- Trending
- Comments
- Latest
Two suspects have been arrested in South Korea after 22 bitcoin worth roughly $1.5 million disappeared from police evidence storage at a Seoul station — not through physical theft, but through a mnemonic recovery phrase that allowed the funds to be silently drained while the storage device remained completely untouched.
The arrests, announced on Feb. 25, 2026, followed a nationwide audit of cryptocurrency custody practices triggered by earlier asset losses across government agencies.
The suspects are accused of illegally transferring Bitcoin seized during a 2021 hacking investigation connected to the so-called A Coin Foundation case.
The funds were held at the Gangnam Police Station in Seoul but reportedly disappeared despite the physical storage device remaining intact.
Authorities say the investigation is ongoing and the stolen crypto has not yet been recovered.
The missing cryptocurrency originated from a 2021 probe into alleged token-related hacking activities.
Police seized the Bitcoin as evidence and stored it using a cold wallet, a device typically considered secure because it remains offline.
However, investigators later discovered a critical operational flaw: the wallet used to store the funds had been supplied by the foundation involved in the case itself rather than by an independent government-controlled system.
According to investigators, the suspects allegedly exploited access to the wallet’s mnemonic recovery phrase, essentially the master key that allows funds to be restored and transferred from anywhere.
With that information, the Bitcoin could be moved without physically accessing the device.
“The portable cold wallet remained intact, but the Bitcoin stored inside had vanished.”
Officials said, describing how the transfer occurred digitally rather than through physical theft.
Police statement cited by Seoul Economic Daily. The breach came to light during a nationwide inspection ordered after a separate case involving missing cryptocurrency from prosecutors’ custody raised alarms about institutional crypto security.
The Gyeonggi Northern Provincial Police Agency confirmed that the two suspects, both reportedly in their 40s, were detained on charges related to violations of South Korea’s Information and Communications Network Act.
Officials emphasised that the suspects were not police officers but individuals connected to the earlier investigation.
Authorities are still examining whether additional parties were involved and how the security lapse occurred.
“We are investigating the circumstances surrounding the virtual asset leak, and as the investigation is still ongoing, we cannot confirm any specifics.”
Official, Gyeonggi Northern Provincial Police Agency, quoted in local reporting.
The case has also revived scrutiny of earlier misconduct tied to the investigation.
Court records show that a former senior police officer who handled the original case was sentenced to 18 months in prison in August 2024 after accepting bribes linked to the foundation involved.
South Korea’s National Police Agency has already announced reforms aimed at preventing similar incidents.
Planned measures include assigning dual custodians to manage seized digital assets, sealing recovery phrases separately, and transferring custody to specialized asset-management entities.
The reforms come as South Korea increasingly treats cryptocurrency as legally recognized property subject to seizure under criminal law.
Security experts say the episode highlights a broader institutional learning curve as governments worldwide move deeper into crypto enforcement.
“Cryptocurrency custody requires operational security, specialized key management, and isolation from everyday computing environments.”
Industry analysts noted in investigations into similar losses involving public agencies.
The incident reinforces concerns about custodial risk, whether assets are held by exchanges, institutions, or even state authorities.
While cryptocurrency thefts involving exchanges or hackers are common, losses from government custody remain relatively rare and, therefore, more alarming to markets watching institutional adoption.
The disappearance of evidence-held Bitcoin demonstrates that crypto security failures often stem not from blockchain vulnerabilities but from flawed procedures surrounding private keys.
With billions of dollars in digital assets now seized or managed by authorities globally, similar risks may emerge elsewhere if custody standards lag behind adoption.
As investigations continue, South Korean authorities face pressure to recover the funds and restore confidence in official crypto handling.
