The National Tax Service (NTS) of South Korea turned a routine enforcement victory into a historic operational failure this week, leaking private keys in a press release that resulted in the theft of $4.8 million in seized assets.
The agency published unredacted high-resolution photos of hardware wallets containing a visible seed phrase leak, allowing opportunistic on-chain actors to drain 4 million PRTG Tokens remotely.
It was a preventable catastrophe. Instead of securing the crypto seizure in new government-controlled wallets, authorities displayed the original recovery codes to the public eye. The funds were gone within hours.
Key Takeaways:
- The Leak: The NTS published press photos featuring legible handwritten notes containing the 24-word recovery phrases for seized Ledger wallets.
- The Loss: Thieves drained approximately 4 million PRTG tokens, valued at roughly $4.8 million (6.9 billion KRW), using the exposed codes.
- The Failure: The incident exposes a critical gap in Institutional Custody protocols, as agents failed to transfer assets to secure storage before publicity.
Discover: The best crypto to diversify your portfolio with
How The National Tax Service of South Korea Lost $5 Million in Crypto in Hours
On February 26, the National Tax Service issued a press release announcing the seizure of 8.1 billion KRW ($5.5 million today) from high-net-worth tax evaders.
Hilarious.
South Korea’s National Tax Service published their recent confiscation of stolen crypto by showing a photo of the seed phrase they retrieved.
$4.8 million was immediately drained. pic.twitter.com/cKyYBq60Jn— Terence Michael (@ProofOfMoney) March 2, 2026
To illustrate the action, the agency included photos of the physical assets, including a Ledger hardware wallet. Beside the device lay a handwritten note containing the complete mnemonic recovery phrase, the master key that grants full access to the funds regardless of who holds the physical device.
The image was high enough resolution that the words were legible. For anyone with a basic understanding of crypto self-custody, the photo was equivalent to posting a bank account number and PIN on a billboard.
According to Gizmodo and local reports, the theft occurred in two waves. A first actor drained the wallet but, perhaps fearing the consequences of stealing from the government, returned the funds shortly after.
A second thief was less scrupulous. Roughly 2.5 hours later, this second actor transferred the restored funds out permanently.
Police are now investigating, but the blockchain’s immutability makes retrieval difficult without the thief’s cooperation.
The Scale of the Loss
The financial damage is substantial, though market realities may blunt the thief’s actual payday.
The wallet contained 4 million PRTG (Pre-Retogeum) tokens, with a nominal value of approximately $4.8 million or 6.9 billion KRW. On-chain data shows the attacker funded the wallet with a small amount of ETH to cover gas fees before executing three rapid outbound transactions.
While the paper loss is nearly $5 million, liquidity for PRTG is thin. Dumping that volume on open markets would likely crash the price, meaning the realizable value for the hacker is significantly lower.
However, for the NTS, the loss is absolute; credits that were intended to satisfy tax debts have been wiped from the treasury’s balance sheet.
Institutional Custody: What Went Wrong
This was not a technical hack. It was a failure of procedure. Institutional custody requires more than just seizing a physical device; it mandates the immediate transfer of digital assets to a secure, government-controlled environment.
Leaving funds in a suspect’s original wallet and then photographing the recovery phrase betrays a fundamental misunderstanding of how digital bearer assets work.
South Korean shares sank 12%, posting the biggest drop in their 46-year history and wiping out about half a trillion dollars in value this week, as fears that the Iran war could cripple Asia’s fourth-largest economy sent the won to a 17-year low https://t.co/R17XR8DHmL pic.twitter.com/lNzRyejj21
— Reuters (@Reuters) March 4, 2026
The error highlights a stark contrast in regional institutional competence. While the Bank of Japan is rigorously testing blockchain infrastructure for high-level reserve settlements, South Korean tax authorities failed the most basic test of digital asset security: keeping the password secret.
The NTS has since apologized and pledged to revise its manuals, but the damage to credibility is done. Recovering the funds now depends entirely on police tracking, a reactive measure for a problem that was proactively created.
Discover: The best meme coins on Solana
Beyond South Korea: Broader Implications for Crypto Enforcement
South Korea is one of the world’s most active crypto markets, and its government has been aggressive in taxing digital wealth. This incident undermines that authority. It signals that while the state is capable of identifying tax evaders, it lacks the operational maturity to handle the resulting seizures securely.
The risk profile for traders in the region is shifting. Usually, the concern is regulatory overreach. When war with Iran broke out, Iranian exchange outflows jumped 700%. Here, the risk is different: sovereign incompetence. If seizure equals loss, the enforcement mechanism itself becomes a source of market instability.
As governments worldwide ramp up crypto seizures, the NTS blunder serves as a costly lesson. Physical possession means nothing on the blockchain. Without strict digital hygiene, state agencies are just as vulnerable as the retail investors they aim to regulate.
The post South Korea Tax Service Leaks Seed Phrases, Loses $4.8M in Seized Crypto appeared first on Cryptonews.
