South Korean authorities are investigating how 22 Bitcoin seized in a 2021 criminal case was moved out of police custody without authorization.
Key Takeaways
- 22 Bitcoin seized in November 2021 went missing from a police held USB cold wallet.
- The physical device stayed in police custody, but the Bitcoin was transferred using access to the digital keys.
- The loss was found during a nationwide inspection of how agencies store seized crypto after a separate 320 Bitcoin case.
- The Gyeonggi Bukbu Provincial Police Agency launched an internal probe and has not confirmed recovery.
What Happened?
A cold wallet held by Seoul’s Gangnam Police Station was found to be missing 22 Bitcoin that had been secured during a 2021 investigation. Officials say the coins were moved to an external electronic wallet even though the physical USB device remained intact and in police possession.
The leak surfaced during a nationwide review of seized virtual asset storage practices, triggering an internal investigation into key handling and possible internal involvement.
Korean police just learned the hardest lesson in crypto custody:
— Oliur (@AbuJimad) February 13, 2026
if you don’t control the keys, you don’t control anything, even when you think you do.
Gangnam Police reportedly lost 22 BTC from a USB cold wallet seized back in 2021.
No device stolen.
No break-in.
Just funds… pic.twitter.com/YPe7cvBCZK
22 Bitcoin Vanish From Police Held Cold Wallet
The missing Bitcoin traces back to a financial and criminal proceeds case linked to virtual assets. Police said suspects voluntarily submitted the Bitcoin in November 2021, providing a USB style cold wallet used to store crypto offline.
Cold wallets are typically viewed as a safer option because they are not connected to the internet. But the Gangnam case highlights a key weakness in evidence storage: even if the hardware is secure, whoever controls the private keys or access phrases can still move the funds.
During an internal check, authorities confirmed the Bitcoin had been transferred out of the wallet without approval. Investigators say the cold wallet itself was not stolen. There were no immediate signs of physical tampering. Yet the coins were still siphoned off, suggesting the critical point of failure was access to the wallet credentials rather than the device.
Nationwide Inspection Triggered by Separate 320 Bitcoin Loss
This incident did not come to light on its own. It was uncovered as part of a nationwide inspection of investigative agencies’ handling of virtual assets, launched after a separate high profile loss involving 320 Bitcoin from the Gwangju District Prosecutors’ Office.
Local reports said the Gwangju case involved evidence managers mistakenly accessing a phishing website, which led to seized Bitcoin being drained. That earlier event pushed authorities to review how seized crypto is stored across agencies, and that review is what reportedly flagged the Gangnam Police Station loss.
In the Gangnam case, officials confirmed the Bitcoin was moved to an external electronic wallet. The value has been reported at around 2.1 billion won based on market rates on the day the incident was identified, or roughly $1.5 million in other reports.
Why the Leak Went Undetected for So Long?
A key detail in the Gangnam case is timing. Police said the investigation was suspended because the suspect’s whereabouts were unknown. That meant the evidence sat for a long period without disposal procedures or active handling.
Because the case was effectively frozen, the missing Bitcoin was not noticed until the nationwide inspection took place. The long gap between seizure and discovery is now raising uncomfortable questions about monitoring, auditing, and access control for crypto held as evidence.
This also underlines a basic operational problem. If agencies store seized digital assets for years, they need routine checks that confirm the funds are still present, not just that a device is still sitting in an evidence room.
Police Launch Internal Probe and Review Access Controls
The Gyeonggi Bukbu Provincial Police Agency has opened an internal investigation to determine how the Bitcoin was moved and whether any officers were involved. Investigators are reviewing wallet key management, potential access logs, and related digital records.
Authorities have not publicly accused any personnel, and they have not said whether any of the missing Bitcoin has been recovered or traced. Police are also reviewing blockchain transactions to follow the trail of the funds, though they have not shared results so far.
A source from the agency said, “We cannot provide specific details as the investigation into the exact circumstances of the leak and any internal involvement is still ongoing.”
CoinLaw’s Takeaway
I find this case worrying because it shows how crypto evidence can disappear even when the physical storage looks secure. In my experience, organizations often focus on guarding the hardware and forget the real crown jewel is the private key. If key handling is weak, the cold wallet becomes a false sense of safety.
What makes this worse is the time gap. The Bitcoin was seized in 2021, and it took a separate scandal for anyone to notice it was gone. That tells me audits were not happening often enough, or they were not designed to confirm the funds were still on chain. If South Korea wants to show strong enforcement in crypto cases, it also needs stronger custody rules so seized assets are tracked, verified, and protected with the same seriousness as cash and gold.
