Police are investigating the unauthorized transfer of cryptocurrency seized by the National Tax Service (NTS), which accidentally disclosed a cryptocurrency wallet recovery phrase — a series of words that allows access to and restoration of a crypto wallet — in a press release photo.
The issue traces back to a press release on Thursday. The NTS stated that it had seized four Cold Wallet devices — offline devices used to store cryptocurrency — from a drawer at the residence of a taxpayer who owed capital gains tax. A photo attached to the release clearly displayed the mnemonic code. Anyone with the code can restore and access the cryptocurrency through a compatible wallet program without physically possessing the Cold Wallet.
The Korean National Police Agency’s Cyber Terror Response Division then received an online report on Saturday from a person who claimed to have tried to “access the cryptocurrency out of curiosity after seeing the exposed code.” The person also claimed to have returned the assets the next day. Police plan to review transaction records to verify the account.
Before that report surfaced, the NTS had already requested a police investigation on Friday after cryptocurrency it had confiscated from a high-income delinquent taxpayer moved out of a Cold Wallet. The assets consisted of 4 million PRTG tokens worth about 6.9 billion won ($4.8 million).
Cho Jae-woo, a professor at Hansung University and head of its Blockchain Research Institute, posted an analysis of the token movements on his X account on Friday.
He showed that 4 million PRTG tokens moved to a single wallet between 7:43 p.m. and 8:13 p.m. on Thursday, shortly after the press release was shared. The tokens moved again to another wallet at 12:06 p.m. the next day.
The NTS apologized on Sunday.
“We failed to recognize that the original photo contained sensitive virtual asset information and provided it to the media without proper caution,” the NTS said in a statement. “This is entirely the National Tax Service’s fault.”
Deputy Prime Minister and Finance Minister Koo Yun-cheol also addressed the matter on X.
“We will inspect the status and management of digital assets held by the government and public institutions and promptly prepare and implement measures to prevent a recurrence, including strengthening digital asset security management,” Koo wrote.
A recent case at Seoul Gangnam Police Precinct in Gangnam District, southern Seoul, also stemmed from poor management of mnemonic codes.
Authorities from the cyber investigation unit of the Gyeonggi Bukbu Provincial Police Agency on Friday identified the operator of Queenbee Coin as the main suspect in the Bitcoin theft and took them into custody under the Act on Promotion of Information and Communications Network Utilization and Information Protection (also called The Network Act).
Investigators allege that after the Gangnam Police Precinct took custody of a Cold Wallet holding 22 Bitcoins in November 2021, now worth about 2 billion won ($1.5 million), the operator used a mnemonic code they already knew to restore the wallet through another wallet program and transferred the Bitcoin to a new address without authorization while they remained under police control.
Prosecutors also suspect similar management failures in a separate case in February at the Gwangju District Prosecutors’ Office involving the transfer of 320.88 Bitcoins.
In both cases, authorities stored seized cryptocurrency in Cold Wallets that remained under the control of people involved in the cases.
Police introduced new measures on Feb. 23 to tighten the management of seized virtual assets across the country. Authorities plan to entrust confiscated cryptocurrency to specialized custodial firms within the year and establish formal rules governing the storage of digital assets.
“We will designate two officials, the evidence manager and the lead investigator, to take joint responsibility for managing Cold Wallets,” a police official said. “When configuring security settings, we will split control of the recovery phrase, or mnemonic code, and the password between them. Each month, the supervising investigator will check the balance of the cryptocurrency address and conduct inspections. We have established a step-by-step management system covering seizure, storage and transfer.”
This article was originally written in Korean and translated by a bilingual reporter with the help of generative AI tools. It was then edited by a native English-speaking editor. All AI-assisted translations are reviewed and refined by our newsroom.
BY SON SUNG-BAE [[email protected]]
