Clueless Cops Post Seized Crypto Wallet Password – $5M Quickly Stolen
South Korean authorities deeply apologized for a preventable loss of seized funds.In a surprising and embarrassing mistake, South Korea’s National Tax Service (NTS) accidentally shared secret recovery codes for seized cryptocurrency wallets in a public press release. Within hours, someone used those codes to steal nearly $5 million worth of the assets. This happened on February 26, 2026, during a big operation against tax evaders. The NTS later said they were “deeply sorry” and promised to investigate fully.What Exactly Happened? A Simple TimelineOn February 26, 2026, the National Tax Service announced good news: They had seized cryptocurrency worth about 8.1 billion Korean won (roughly $5.6 million USD) from 124 people who owed taxes. These were high-value and repeat tax delinquents. The NTS wanted to show the public they were serious about collecting unpaid taxes.To make the announcement more interesting, they posted photos of the items they took. The pictures showed Ledger hardware wallets (cold storage devices that keep crypto safe offline) and, right next to them, handwritten notes. Those notes clearly displayed the mnemonic seed phrases – the 12 or 24 secret words that act like a master key to the wallet.Anyone who saw the photos could read the words easily. These seed phrases let a person fully control the wallet without needing the original owner’s password.The press release went online. Soon after, an unknown person spotted the photos, copied the seed phrase, and took action. They first sent a small amount of Ethereum (ETH) to one of the wallet addresses to pay for “gas fees” (the small cost to make transactions on the Ethereum blockchain). Then, they moved out about 4 million tokens called Pre-Retogeum (PRTG). The stolen amount was worth nearly $4.8 million – almost all of the valuable crypto that had been seized.The theft happened very quickly, showing how fast crypto can move once someone has the key.The Official Apology and InvestigationOn Sunday (March 1 or 2, depending on time zones), the NTS posted a second press release. They “deeply” apologized to the public for the mistake. They explained that the photos were meant to give “more vivid information” and make the announcement eye-catching. But they admitted they forgot to hide or blur the seed phrases. They called it a careless error with no excuse.The NTS said they are now working closely with South Korea’s National Police Agency. Because every crypto transaction is recorded forever on the public blockchain (a kind of digital ledger everyone can see), investigators can track where the money went. They are trying to find the person who took it and get the funds back if possible.As of March 3, 2026, no suspects have been named publicly. Some experts wonder if it was a “white hat hacker” – someone who takes funds only to show a security problem and might return them later. But the NTS is treating it as a real theft and is making “every effort” to recover the assets.Why Seed Phrases Are So Important in CryptoTo understand the mistake, let’s explain crypto basics simply.Cryptocurrency is digital money stored in “wallets.” There are two main types:
South Korean authorities deeply apologized for a preventable loss of seized funds.In a surprising and embarrassing mistake, South Korea’s National Tax Service (NTS) accidentally shared secret recovery codes for seized cryptocurrency wallets in a public press release. Within hours, someone used those codes to steal nearly $5 million worth of the assets. This happened on February 26, 2026, during a big operation against tax evaders. The NTS later said they were “deeply sorry” and promised to investigate fully.What Exactly Happened? A Simple TimelineOn February 26, 2026, the National Tax Service announced good news: They had seized cryptocurrency worth about 8.1 billion Korean won (roughly $5.6 million USD) from 124 people who owed taxes. These were high-value and repeat tax delinquents. The NTS wanted to show the public they were serious about collecting unpaid taxes.To make the announcement more interesting, they posted photos of the items they took. The pictures showed Ledger hardware wallets (cold storage devices that keep crypto safe offline) and, right next to them, handwritten notes. Those notes clearly displayed the mnemonic seed phrases – the 12 or 24 secret words that act like a master key to the wallet.Anyone who saw the photos could read the words easily. These seed phrases let a person fully control the wallet without needing the original owner’s password.The press release went online. Soon after, an unknown person spotted the photos, copied the seed phrase, and took action. They first sent a small amount of Ethereum (ETH) to one of the wallet addresses to pay for “gas fees” (the small cost to make transactions on the Ethereum blockchain). Then, they moved out about 4 million tokens called Pre-Retogeum (PRTG). The stolen amount was worth nearly $4.8 million – almost all of the valuable crypto that had been seized.The theft happened very quickly, showing how fast crypto can move once someone has the key.The Official Apology and InvestigationOn Sunday (March 1 or 2, depending on time zones), the NTS posted a second press release. They “deeply” apologized to the public for the mistake. They explained that the photos were meant to give “more vivid information” and make the announcement eye-catching. But they admitted they forgot to hide or blur the seed phrases. They called it a careless error with no excuse.The NTS said they are now working closely with South Korea’s National Police Agency. Because every crypto transaction is recorded forever on the public blockchain (a kind of digital ledger everyone can see), investigators can track where the money went. They are trying to find the person who took it and get the funds back if possible.As of March 3, 2026, no suspects have been named publicly. Some experts wonder if it was a “white hat hacker” – someone who takes funds only to show a security problem and might return them later. But the NTS is treating it as a real theft and is making “every effort” to recover the assets.Why Seed Phrases Are So Important in CryptoTo understand the mistake, let’s explain crypto basics simply.Cryptocurrency is digital money stored in “wallets.” There are two main types:
- Hot wallets: Connected to the internet (like apps on phones). Convenient but easier to hack.
- Cold wallets (like Ledger devices): Kept offline for safety. These are what the NTS seized.
- In February 2026, 22 Bitcoin (worth about $1.5 million at the time) disappeared from a police cold wallet at a station in Seoul. It had been seized years earlier.
- Earlier, the Gwangju District Prosecutor’s Office lost 320 Bitcoin (around $48 million) from seized assets due to a password leak after a phishing attack on an employee.
- Never photograph or share seed phrases – Even if you think the photo is private.
- Blur or redact sensitive information before posting anything online. A quick check with a crypto expert could have prevented this.
- Use proper custody methods for large amounts. Many experts recommend multi-signature wallets (need more than one key to move money) or professional custody services for seized assets.
- Test recovery phrases carefully in a safe way, but never expose them.
- Blockchain is public – Once money moves, everyone can see the path. This helps police but also means thieves know it is real.
- The thief could send the tokens through mixers or privacy tools to hide the trail.
- If the person is outside South Korea, international cooperation is needed.
- Even if caught, getting the exact same tokens back depends on whether they have been spent or converted.
- Government-grade cold storage with extra security layers.
- Training programs for officers on blockchain basics.
- Partnerships with crypto companies that specialize in secure custody.
- Buy a hardware wallet for large amounts.
- Write the seed phrase once, on paper, and store it safely.
- Never take photos of it.
- Test the wallet with a tiny amount first.
- Use strong passwords and two-factor authentication on exchanges.
- If you ever need to share wallet info (rare), do it only in person and securely.
- Consider multi-signature setups for big holdings.
Comments