South Korea’s National Tax Service made a costly mistake after accidentally revealing the recovery phrase of a seized cryptocurrency wallet, allowing someone to steal millions in digital assets.
The wallet had been confiscated during raids on 124 high-value tax evaders. Authorities said the operation resulted in the seizure of digital assets worth 8.1 billion won, or about 5.6 million dollars. The funds were stored in a Ledger cold wallet, a popular hardware device used to securely manage crypto.
When announcing the success of the crackdown, the agency shared photos of the seized items, including the Ledger device. However, the images also showed a handwritten note containing the wallet’s mnemonic recovery phrase. This phrase acts as a master key and can restore full access to the wallet on any compatible device.
The sensitive information was not blurred or removed from the photos. As a result, anyone who saw the images had everything they needed to take control of the wallet.
Not long after the press release went public, 4 million Pre Retogeum (PRTG) tokens were transferred out of the seized wallet. At the time, the tokens were worth around 4.8 million dollars. According to Korean media reports, blockchain data from Etherscan shows that the attacker first sent a small amount of Ethereum to the wallet to cover gas fees. The person then moved the 4 million PRTG tokens to a new address in three separate transactions.
Cho Jae woo, a blockchain data analysis expert and professor at Hansung University in Seoul, monitored the transfers. He compared the mistake to leaving a wallet open in public and inviting the entire country to take the cash inside. He said the incident reflected a basic lack of understanding of virtual assets within the tax authority. The error may have cost the national treasury tens of billions of won that had already been successfully confiscated.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
The press release has since been removed from the National Tax Service website. It is still unclear whether an investigation has begun to track where the stolen funds were sent or to identify the person responsible.
