South Korea tax service reveals crypto wallet recovery phrase in press release, seized tokens moved in suspected breach: report

South Korea’s National Tax Service (NTS) revealed the recovery phrase of a seized cryptocurrency wallet in a public press release photo, after which digital assets theoretically worth $4.8 million were moved in a suspected breach, according to local outlet Maeil Business Newspaper.

The report said the NTS published materials on Friday detailing on-site seizures involving 124 high-value and habitual tax delinquents, stating it had confiscated assets worth a combined 8.1 billion won ($5.6 million). In one case, authorities said they seized four USB devices used to store digital assets from an individual identified as “Mr. C.”

A photo included in the press release showed a hardware wallet device identified as a Ledger cold wallet alongside a sheet of paper containing a mnemonic recovery phrase, Maeil reported. The recovery phrase — which allows anyone to restore and control the wallet’s funds — appeared clearly visible without redaction.

Tokens transferred after disclosure

According to Professor Cho Jae-woo of Hansung University’s Blockchain Research Institute, blockchain data shows that shortly after the mnemonic was exposed — around early morning on Feb. 27 — 4 million Pre-Retogeum (PRTG) tokens held in the wallet were transferred in full to an unidentified address, the outlet said. The tokens were theoretically valued at about 6.4 billion won ($4.8 million) based on prevailing market prices.

Onchain data from Etherscan indicate that the party who moved the funds first deposited a small amount of ETH into the wallet to cover transaction fees, then transferred the 4 million PRTG tokens out in three transactions.

However, market data suggests limited liquidity. CoinMarketCap shows PRTG recorded just $332 in 24-hour trading volume and is listed on a single exchange, MEXC. The token has a reported market capitalization of about $12 million, with the 4 million tokens moved representing 40% of the total supply, suggesting that converting a large portion of the tokens into cash at prevailing prices would prove difficult under current market conditions.

Nevertheless, experts criticized the incident as a preventable security failure. Cho said publishing the mnemonic in a public press release was equivalent to advertising that the wallet was open for anyone to take the funds, adding that insufficient understanding of digital asset management may have cost the government a recovery opportunity.

Hwang Seok-jin, a professor at Dongguk University, told the outlet that photographing and storing a mnemonic code digitally is something that should never be done. He said uploading such an image online is effectively the same as leaving the funds unprotected and stressed that recovery phrases must be recorded on physical media and stored offline.

The incident follows a series of crypto custody lapses involving South Korean authorities in recent months. In January, prosecutors in Gwangju investigated the loss of seized bitcoin that was later linked to a phishing incident involving recovery seed phrases, while earlier this month, police in Seoul’s Gangnam district confirmed that 22 BTC held in a cold wallet since 2021 had been drained, prompting arrests and internal probes.

© 2026 The Block. All Rights Reserved. This article is provided for informational purposes only. It is not offered or intended to be used as legal, tax, investment, financial, or other advice.