South Korea’s National Tax Service (NTS) turned a routine victory into a historic operational failure this week, releasing private keys in a press release that led to the theft of $4.8 million in seized assets.
The agency released unredacted high-resolution photos of hardware wallets containing a visible seed phrase leak, allowing opportunistic on-chain actors to drain 4 million PRTG tokens remotely.
It was an avoidable disaster. Instead of securing crypto entry into new government-controlled wallets, authorities posted the original recovery codes to the public. The funds disappeared within hours.
- The escape: The NTS released press photos showing legible handwritten notes containing the 24-word recovery phrases for the seized Ledger wallets.
- The loss: The thieves stole around 4 million PRTG tokens, worth around $4.8 million (KRW 6.9 billion), using the exposed codes.
- Failure: The incident reveals a critical gap in Institutional custody protocols, as agents failed to transfer assets to secure storage prior to publicity.
Discover: The best crypto to diversify your portfolio
How South Korea’s National Tax Service Lost $5 Million in Crypto in Hours
On February 26, the National Tax Service issued a press release announcing the seizure of 8.1 billion KRW ($5.5 million today) from wealthy tax evaders.
To illustrate the action, the agency included photos of the physical assets, including a Ledger hardware wallet. Next to the device is a handwritten note containing the full recovery mnemonic phrase, the master key that grants full access to the funds, regardless of who owns the physical device.
The image had a high enough resolution that the words were readable. To anyone with a basic understanding of crypto self-custody, the photo was the equivalent of posting a bank account number and PIN on a billboard.
According to Gizmodo and local news reports, the theft happened in two waves. An initial actor emptied the wallet but, perhaps fearing the consequences of stealing from the government, returned the funds shortly thereafter.
A second thief was less scrupulous. Approximately 2.5 hours later, this second actor permanently transferred the restored funds.
Police are currently investigating, but the immutability of blockchain makes recovery difficult without the thief’s cooperation.
The extent of the loss
The financial damage is considerable, even if market realities may reduce the thief’s real salary.
The wallet contained 4 million PRTG (Pre-Retogeum) tokens, with a face value of approximately $4.8 million or 6.9 billion KRW. On-chain data shows that the attacker funded the wallet with a small amount of ETH to cover gas fees before executing three quick outgoing transactions.
While the paper loss amounts to nearly $5 million, PRTG’s liquidity is thin. Dumping this volume onto open markets would likely cause the price to drop, meaning the realizable value to the hacker would be significantly lower.
However, for the NTS, the loss is absolute; credits intended to settle tax debts were erased from the Treasury balance sheet.
Institutional placement: what went wrong
It wasn’t a technical hack. It was a procedural failure. Institutional detention requires more than just the seizure of a physical device; it requires the immediate transfer of digital assets to a secure, government-controlled environment.
Leaving funds in a suspect’s original wallet and then photographing the recovery phrase betrays a fundamental misunderstanding of how bearer digital assets work.
This error highlights a stark contrast in regional institutional competence. While the Bank of Japan is rigorously testing blockchain infrastructure for high-level reserve settlement, South Korean tax authorities have failed the most basic test of digital asset security: keeping the password secret.
The NTS has since apologized and committed to revising its textbooks, but the damage has been done to its credibility. Recovery of funds now depends entirely on police monitoring, a reactive measure in the face of a proactively created problem.
Discover: The best meme pieces on Solana
Beyond South Korea: Wider Implications for Crypto Application
South Korea is one of the most active crypto markets in the world and its government has been aggressive when it comes to taxing digital wealth. This incident undermines that authority. This shows that even if the state is capable of identifying tax evaders, it lacks the operational maturity to safely manage the resulting seizures.
The risk profile of retailers in the region is changing. Usually the concern is about regulatory overreach. When the war with Iran broke out, Iranian currency outflows jumped 700%. Here, the risk is different: sovereign incompetence. If seizure amounts to a loss, the enforcement mechanism itself becomes a source of market instability.
As governments around the world ramp up cryptocurrency seizures, the NTS mistake presents a costly lesson. Physical possession means nothing on the blockchain. Without strong digital hygiene, state agencies are just as vulnerable as the retail investors they aim to regulate.
South Korean Tax Service Leaks Seed Phrases, Loses $4.8M in Seized Crypto appeared first on Cryptonews.
