South Korea Tax Office Leaks Cryptocurrency Assets, Critical Failure Leads to Wallet Breach
Published
Key Takeaways
- Operational Failure: The National Tax Service inadvertently published a seed phrase in press materials, compromising a seized wallet.
- Asset Theft: Unauthorized actors exploited the leak and drained approximately $4.8 million in Pre-Retogeum tokens.
- Procedural Review: The agency has issued an apology and is overhauling its digital asset handling protocols.
A security failure at South Korea's National Tax Service resulted in the theft of seized digital assets. On February 26, the agency announced a successful raid on tax delinquents, seizing â‚©8.1 billion ($5.6 million) in assets, and released press materials to publicize the enforcement action.
However, they included unredacted photographs showing a cryptocurrency wallet's recovery credentials, which gave external actors the keys needed to access and control the seized funds.
Seed Phrase Exposure Facilitates Heist
This South Korean tax office leak reportedly included the recovery access key of a wallet containing Pre-Retogeum (PRTG) tokens.Â
Within hours of the press release, threat actors identified the credentials in the media images and executed a blockchain heist, transferring approximately $4.8 million worth of tokens to external addresses.Â
While the immutable nature of the blockchain enables tracking of these transactions, the anonymity of unhosted wallets makes recovering the stolen assets a complex forensic challenge for authorities.
Agency Response and Protocol Overhaul
In the aftermath of the cryptocurrency wallet breach, reports say the National Tax Service has apologized and engaged the National Police Agency to investigate the theft, which suggests the agency may have already revised manuals regarding the seizure, custody, and disposal of virtual assets.Â
In December 2025, a KMSAuto clipper malware-linked hacker was arrested, and a €700 million crypto fraud and laundering network was dismantled in an international operation. In another leak incident, the Abu Dhabi Finance Week exposed passport information for global figures due to a lapse in cloud server security.
Related
Get expert insights on threats, breaches, scams, and security trends — delivered every Monday.
Most Popular
Get expert insights on threats, breaches, scams, and security trends — delivered every Monday.
Most Popular