South Korea’s National Tax Service is scrambling to recover millions in seized cryptocurrency after it accidentally revealed wallet recovery phrases in a public photo.
Key Takeaways
- South Korea’s National Tax Service published an unredacted photo that exposed seed phrases linked to seized crypto wallets.
- Within hours, an attacker used the phrases to move about 4 million Pre Retogeum tokens, widely reported at roughly $4.8 million at the time.
- The government has asked police to intervene and announced a broader review of how agencies seize and manage digital assets.
- Experts say the incident shows a serious gap in operational security and basic crypto handling.
What Happened?
On February 26, the National Tax Service released a press announcement about its crackdown on chronic tax and fine defaulters. Photos meant to showcase seized assets appeared to include handwritten wallet recovery phrases, allowing anyone to recreate access to the wallets and transfer the funds.
Soon after the images spread, the seized crypto was drained, triggering a police request and a government level investigation.
🚨 ALERT: South Korea’s tax agency accidentally leaked a crypto wallet seed phrase in a press release, leading to a $4.8M token theft. pic.twitter.com/Sgojzs7ly2
— Cointelegraph (@Cointelegraph) February 27, 2026
A photo meant to prove success became the point of failure
South Korea’s tax agency has been publicizing crypto seizures as part of a broader push to enforce unpaid taxes and fines among digital asset holders. In this case, the agency said it had seized assets from 124 habitual tax evaders, after agents carried out on site searches and took control of items including cash and hardware wallets.
But the promotional effort backfired. The accompanying photograph reportedly showed hardware wallets and at least two seed phrases without any blur or redaction. Seed phrases are typically a set of 12 to 24 words that can restore a wallet anywhere and grant full access to the funds.
Blockchain data watchers say the mistake created an instant opening. Korean media reports cited on chain traces showing the attacker first sent a small amount of Ethereum to cover transaction fees, then moved the tokens out in multiple transfers.
Millions in Pre Retogeum moved out in minutes
The stolen assets were linked to Pre Retogeum, a lesser known token that some reports placed at around $13 million in market value at the time. One widely cited figure says roughly 4 million PRTG were moved from the confiscated wallet, valued at about $4.8 million when the transfers occurred.
A separate version of the story put the potential loss as high as $5 million, though the National Tax Service later pushed back on that estimate. In a March 1 statement carried by Korean media, the agency said the missing assets were worth “far less than the reported figure.”
Officials apologize and ask police for help
The National Tax Service publicly accepted responsibility for the leak. The tax office said:
The agency said it requested police assistance to recover the stolen crypto and announced plans for an external security review and a full overhaul of its procedures from seizure through sale of virtual assets.
It also issued another apology reported by Yonhap, saying it offered its “deepest apologies for causing concern to the public,” and admitting it had acted “carelessly” by providing a photo without recognizing it contained sensitive details.
Experts call out a basic crypto knowledge gap
The incident has drawn sharp criticism from industry observers. “The tax authorities have displayed a basic lack of understanding of how cryptocurrencies work,” Cho Jae woo, director of Hansung University’s Blockchain Research Institute, told Maeil Kyungjae.
Cho also suggested the transfer might have been carried out by a white hat hacker, someone acting to expose a security flaw before returning the funds. The tax service itself said it believed the hacker “only stole the coins out of curiosity,” while still working with police to recover the assets.
Wider probe as earlier mishaps resurface
This case is also reviving scrutiny of past handling failures. Asia Business Daily noted a separate controversy where authorities allegedly lost 22 BTC connected to a 2021 case after leaving funds and seed details with a third party custodian, with suspects later detained. Other reports have also pointed to additional recent losses involving law enforcement and prosecutors, adding to the pressure on agencies managing seized crypto.
Deputy Prime Minister and Minister of Strategy and Finance Koo Yoon chul said Seoul would expand oversight across government. He added that authorities would “quickly establish and implement measures to prevent a recurrence.”
CoinLaw’s Takeaway
I found this incident hard to excuse because seed phrases are the one thing you never expose, whether you are a beginner or a government agency. In my experience, crypto security is mostly about process, not fancy tools. One careless photo can undo months of investigations and turn confiscated assets into a gift for whoever is watching fastest. If South Korea wants crypto seizures to be credible, the rules have to be boring, strict, and followed every time, especially when publicity is involved.
