Author
Ahmed Balaha
Author
Share
Fact verified by
CriptoNoticias editorial team
Author
South Korea’s National Tax Service just made a costly mistake that resulted in a huge crypto loss.
In an official press release, the agency published unedited photos exposing seed phrases of crypto wallets. Within hours, an unknown actor used the information to drain 4 million Ethereum-based tokens, with a face value of $4.8 million, from seized wallets before returning them.
The funds were not discarded, but the incident exposes a serious operational security failure. It highlights the risks governments face when handling self-custodied digital assets without adequate technical safeguards.
Key takeaways
- The span: NTS press materials included high-resolution images of handwritten recovery phrases for seized Ledger hardware wallets.
- The asset: 4 million Pre-Retogeum tokens (PRTG) were taken, with a theoretical value of $4.8 million but almost zero market liquidity.
- The result: The attacker funded the wallets with ETH for gas, moved the tokens, and finally returned them to the original address.
The leak: the Tax Agency publishes the private keys of Ethereum
On February 26, the National Tax Service announced that it had seized approximately 8.1 billion KRW, about $5.61 million, from repeat tax offenders. To show the enforcement action, officials released photographs of the confiscated items, including an exhibit dubbed “Case 3.”
The problem was in the details. The images showed Ledger hardware wallets next to a sheet of paper with the 12-word seed phrases fully visible.
A local professor described the mistake bluntly, likening it to publicly inviting someone to empty their wallet. The incident highlights a basic but critical gap in technical handling, especially as authorities seize and manage more and more digital assets.
Chain data: swipe and return
On-chain data shows that wallets were depleted shortly after the photos were made public. An unknown actor first sent a small amount of ETH to cover gas fees and then transferred 4 million Pre-Retogeum Tokens (PRTG) to a new address.
That amount represented approximately 40% of the token’s total supply. While early reports valued the stash at $4.8 million, the liquidity tells a different story. The only active trading pair is showing minimal volume, and even a small sell order would have crushed the price. Withdrawing money on a large scale was almost impossible.
The tokens were later returned to their original wallets. It is unclear whether this was white hat action or simply a realization that the assets were illiquid.
The episode highlights a basic flaw in custody. The original owner used a hardware wallet for security, but that protection was undone when authorities photographed the opening phrase. The NTS has not yet issued a detailed statement and the incident raises questions about how seized crypto assets will be handled in the future.
Discover: The best new cryptocurrency in the world
