Author
Ahmed Balaha
Author
Share
Fact Checked by
CryptoNews Editorial Team
Author
South Korea National Tax Service just made a costly mistake resulting a huge crypto loss.
In an official press release, the agency published unredacted photos that exposed crypto wallet seed phrases. Within hours, an unknown actor used the information to drain 4 million Ethereum-based tokens, nominally worth $4.8 million, from seized wallets before returning them.
The funds were not dumped, but the incident exposes a serious operational security failure. It highlights the risks governments face when handling self-custodied digital assets without proper technical safeguards.
Key Takeaways
- The Lapse: NTS press materials included high-resolution images of handwritten recovery phrases for seized Ledger hardware wallets.
- The Asset: 4 million Pre-Retogeum (PRTG) tokens were taken, holding a theoretical value of $4.8 million but near-zero market liquidity.
- The Outcome: The attacker funded the wallets with ETH for gas, moved the tokens, and eventually returned them to the original address.
The Leak: Tax Agency Publishes Ethereum Private Keys
On February 26, the National Tax Service announced it had seized roughly 8.1 billion KRW, about $5.61 million, from repeat tax delinquents. To showcase the enforcement action, officials released photos of the confiscated items, including a display labeled “Case 3.”
The problem was in the details. The images showed Ledger hardware wallets next to a sheet of paper with the 12-word seed phrases fully visible.
A local professor described the mistake bluntly, comparing it to publicly inviting someone to empty your wallet. The incident highlights a basic but critical gap in technical handling, especially as authorities increasingly seize and manage digital assets.
On-Chain Data: The Swipe and Return
On-chain data shows the wallets were drained soon after the photos went public. An unknown actor first sent a small amount of ETH to cover gas fees, then transferred 4 million Pre-Retogeum (PRTG) tokens to a new address.
That amount represented roughly 40% of the token’s total supply. While early reports valued the stash at $4.8 million, liquidity tells a different story. The only active trading pair shows minimal volume, and even a small sell order would have crushed the price. Cashing out at scale was nearly impossible.
The tokens were later returned to the original wallets. Whether this was a white-hat action or simple realization that the assets were illiquid is unclear.
The episode highlights a basic custody failure. The original owner used a hardware wallet for security, but that protection was undone when authorities photographed the seed phrase. The NTS has not yet issued a detailed statement, and the incident raises questions about how seized crypto assets will be handled going forward.
Discover: The best new crypto in the world
