Nearly $5 million worth of cryptocurrency has been lost after South Korea’s National Tax Service accidentally shared an image of the passwords for seized crypto wallets.
The tax authority had taken enforcement action against 124 tax evaders, sharing the confiscated assets in a public press release.
Within the release were high-resolution pictures of the seized hardware wallets, which reportedly contained around 8.1 billion won ($5.5m, £41.m).
The images also contained handwritten notes that revealed the wallets’ recovery mnemonics.
A recovery mnemonic, or seed phrase, is a list of 12, 18, or 24 random words that act as the master key for a crypto wallet.
They are designed to allow users to recover their assets in the event of a phone, computer or hardware wallet is lost or stolen.
Shortly after the press release was published on 27 February, an unknown individual used the seed phrases to transfer crypto holdings worth $4.8m to their personal wallet.
Blockchain experts likened the error to posting pictures of a person’s bank card, with all the necessary information visible to make online payments.
“The tax authority’s lack of basic understanding of virtual assets has blown the opportunity to recover tens of billions of won in national treasury,” Professor Cho Jae-woo of Hansung University in Seoul told local media.
“This is like advertising an open wallet and saying ‘take my money’.”
Without knowing the identity of the person who stole the funds, it is unlikely that the National Tax Service will be able to recover them.
If the cryptocurrency is transferred to a regulated exchange, then there is a chance that law enforcement will be able to take control of the assets.
However, the token stolen in the heist, PRTG, is not widely available and is not currently listed on major exchanges.
The PRTG token also has a relatively small market cap of $14 million, meaning that cashing out the full amount stolen on an exchange will likely cause a massive price crash.
