South Korea’s National Tax Service (NTS) accidentally exposed a cryptocurrency wallet’s 24-word seed phrase in a public press release, leading to the theft of approximately $4.8 million (6.4 billion won) in digital assets.

The Security Incident

• The Leak: To highlight successful enforcement against high-value tax evaders, the NTS released a photo of a seized Ledger hardware walletalongside a handwritten note containing its mnemonic recovery phrase.
• The Theft: Within hours of the press release, an unknown actor used the exposed phrase to access the wallet. On-chain data shows the perpetrator first deposited a small amount of Ethereum (ETH)to cover transaction fees before draining 4 million Pre-Retogeum (PRTG) tokens.
• Investigation: The National Police Agency (NPA)has assigned its cyberterrorism response division to track the perpetrator and analyze the asset flow as of February 28, 2026.

Broader Context of Custody Failures

This event marks the third major cryptocurrency custody failure by South Korean authorities in early 2026, totaling over $50 million in lost or stolen seized assets:

• January 2026: Gwangju prosecutors lost $48 million in Bitcoin due to a phishing attack during a wallet storage audit.
• February 2026: Seoul’s Gangnam Police Stationdiscovered that 22 Bitcoin (worth ~$1.4 million) had vanished from a cold wallet because internal procedures failed to secure exclusive access to the seed phrase.
• February 2026: The Bithumb exchange came under investigation for a “fat finger” error that mistakenly credited users with 620,000 BTC(nominally $43 billion) during a promotion.

Experts have heavily criticized the NTS, noting that publishing a seed phrase is equivalent to “advertising to open your wallet and take your money.” While some researchers noted that PRTG tokens have low market liquidity, which may lower the realized damage, the incident remains a landmark failure in institutional digital asset security.