South Korea Tax Agency Loses $4.8M in Crypto After Publishing Wallet Password
South Korea's National Tax Service accidentally published a crypto wallet password in a press release, enabling thieves to steal $4.8M in digital tokens. The incident reveals critical gaps in gover...
South Korea's National Tax Service (NTS) accidentally published a cryptocurrency wallet password in an official press release on February 26, 2026, enabling a thief to drain US$4.8 million in digital tokens within hours of the document going live.
How a Government Press Release Became a Theft Notice
The NTS released the document as part of an enforcement campaign targeting 124 high-value tax delinquents. The release included a photograph of a seized Ledger hardware wallet showing an unredacted handwritten mnemonic seed phrase, the 12-to-24-word master password that controls access to a crypto wallet.
Mission Media
An attacker spotted the phrase, deposited small amounts of Ethereum to cover transaction fees, and moved four million PRTG tokens across three transactions to a single external address. The stolen tokens represented approximately 79% of the total digital assets seized across the entire enforcement campaign, which had a combined value of roughly 8.1 billion won (approximately US$5.6 million).
The NTS quietly removed the press release from its website. As of late February 2026, the agency had issued no public statement and confirmed no investigation.
Jaewoo Cho, Associate Professor at Hansung University's Blockchain Research Center, confirmed the theft via on-chain analysis, stating the NTS failure was "equivalent to advertising an open wallet to the nation due to the agency's lack of virtual asset knowledge."
Cho also noted that PRTG token's extremely low trading volume, approximately US$338 in 24-hour activity on MEXC exchange at the time, would make the stolen tokens difficult to convert to cash, limiting real-world financial damage.
A Pattern of Government Crypto Custody Failures in South Korea
The NTS incident is the third major South Korean government crypto custody failure within a three-month window.
In February 2026, Gangnam Police discovered that 22 Bitcoin (approximately US$1.4 million) seized in a 2021 hacking case had disappeared from a cold wallet stored in a police vault. Investigators found the coins had been moved using a seed phrase that police had never possessed, indicating custody had been delegated to an unvetted third party. Two suspects were arrested.
Separately, an audit of the Gwangju Prosecutors' Office revealed that 320.8 Bitcoin (approximately US$47.7 million) had vanished following a phishing attack. Prosecutors recovered the funds by freezing the attacker's exchange accounts before liquidation, a recovery only possible because the attacker used regulated Korean platforms.
Across all recorded cases, South Korean government agencies have lost approximately 1,742 Bitcoin, representing 75% of 2,333 Bitcoin seized. By comparison, the U.S. government manages over 198,000 Bitcoin without comparable losses on record.
Regulatory Pressure Mounts as South Korea Develops New Custody Standards
South Korea's Financial Services Commission is also conducting an active investigation into Bithumb, the local crypto exchange that briefly credited users with approximately US$43 billion in non-existent Bitcoin due to a promotional system error.
South Korea's Virtual Asset Phase 2 Act is currently in development, with stricter custody standards, certification requirements, and regulatory oversight mechanisms under consideration. Experts warn that without specialized training and dedicated digital asset forensics capabilities, legislative reforms risk being insufficient.
Professor Cho expressed hope the NTS incident would serve as a catalyst for Korean public bodies to establish proper digital asset custody systems.
Want to stay up-to-date on the stories shaping Asia's media, marketing, and comms industry? Subscribe to Mission Media for exclusive insights, campaign deep-dives, and actionable intel.
