Korean Tax Agency Blunder Leads to $4.8M Cryptocurrency Theft

A significant security lapse by South Korea’s National Tax Service (NTS) has resulted in the theft of approximately $4.8 million in cryptocurrency. The incident occurred after the agency inadvertently revealed the mnemonic recovery phrase of a seized cryptocurrency wallet in an official press release. This oversight allowed hackers to gain full access to the wallet’s contents.

The wallet in question was a Ledger cold wallet, a popular hardware device for securely storing cryptocurrency. It had been confiscated during a law enforcement operation targeting 124 high-value tax evaders. The operation successfully seized digital assets worth 8.1 billion won, equivalent to about $5.6 million at the time. However, the agency’s failure to redact sensitive information from the press release overshadowed this success.

How the Security Breach Occurred

In its announcement, the NTS shared images of the seized Ledger wallet to highlight the success of their operation. Unfortunately, these images also included a handwritten note containing the wallet’s recovery phrase. This phrase serves as a master key, enabling anyone with access to recreate the wallet and transfer its funds to another device.

Shortly after the press release was published, unauthorized transactions were detected. Hackers transferred 4 million Pre-Retogeum (PRTG) tokens, valued at approximately $4.8 million, from the confiscated wallet to a new address. Blockchain analysis revealed that the attackers first deposited a small amount of Ethereum (ETH) into the wallet to cover transaction fees, then executed three separate transactions to move the stolen tokens.

Expert Reactions to the Incident

Cho Jae-woo, a blockchain data analysis expert and professor at Hansung University in Seoul, criticized the NTS for their lack of understanding of virtual assets. He likened the mistake to leaving a wallet open and publicly inviting theft. The professor emphasized that this blunder cost the national treasury tens of billions of won, undermining the success of the initial operation.

The incident has sparked widespread concern about the handling of digital assets by government agencies. Critics argue that proper training and protocols are essential to prevent similar mistakes in the future.

Lessons for Cryptocurrency Security

This case serves as a stark reminder of the importance of safeguarding wallet recovery phrases. A recovery phrase provides complete access to a cryptocurrency wallet, bypassing the need for the physical device, PIN, or any other security measures. If exposed, it can lead to the total loss of funds.

Experts recommend never digitizing recovery phrases or storing them in electronic formats such as emails, cloud storage, or messaging apps. Instead, they should be written down and stored securely in a physical location. If a recovery phrase is compromised, all funds should be immediately transferred to a new wallet to mitigate potential losses.

Aftermath and Unanswered Questions

The NTS has since removed the press release from its website, but questions remain about the stolen funds’ current whereabouts. It is unclear whether an official investigation has been launched to trace the hackers or recover the assets. The incident highlights the critical need for robust security measures and a deeper understanding of cryptocurrency management within government institutions.

As digital assets become increasingly integrated into financial systems, the risks associated with their mishandling grow. This case underscores the importance of vigilance, education, and secure practices for both individuals and organizations handling cryptocurrency.