South Korea's Tax Agency Leaks Seed Phrase in Press Release — $4.8M Drained in Hours
South Korea's National Tax Service (NTS) accidentally exposed a crypto wallet seed phrase in an official press release. Within hours, 4 million Pre-Retogeum (PRTG) tokens worth approximately $4.8 million were drained from the confiscated wallet. The incident highlights a critical gap in government crypto asset handling.
What Happened
The NTS conducted raids on 124 high-value tax evaders, confiscating digital assets worth 8.1 billion won (~$5.6M) stored in a Ledger cold wallet. When the agency published a press release celebrating the seizure, the accompanying photos showed the Ledger hardware wallet — and a handwritten note containing the wallet's recovery seed phrase clearly visible in the image.
The seed phrase is the master key to any crypto wallet. Anyone who reads it can restore the wallet on any device and transfer all funds. No password, no 2FA, no authorization needed.
The Attack Chain
The theft unfolded methodically:
- NTS publishes press release with photos showing the seed phrase
- Attacker reads seed phrase from published images
- Attacker restores wallet on their own device using the 24-word mnemonic
- Deposits small amount of ETH into the wallet to cover gas fees
- Transfers 4M PRTG tokens in three separate transactions to attacker-controlled wallet
- Funds gone — blockchain transactions are irreversible
On-chain analysis via Etherscan confirmed the three-transaction drain pattern, a common technique to avoid triggering automated monitoring alerts.
Why Seed Phrases Are the Master Key
A seed phrase (BIP-39 mnemonic) is a 12 or 24-word sequence that derives every private key in a crypto wallet. It's the complete backup — and the complete vulnerability:
- No authentication required — the seed phrase IS the authentication
- No 2FA protection — unlike bank accounts, there's no second factor
- Irreversible transfers — no bank to call, no chargeback, no recovery
- By design — this isn't a bug, it's how self-custody works
This is why the crypto security mantra exists: "Not your keys, not your crypto. Show your keys, not your crypto either."
The Operational Security Failure
Professor Cho Jae-woo of Hansung University in Seoul, a blockchain data analysis expert who observed the on-chain transfers, described the blunder:
"It's like leaving a wallet open and advertising it to the entire nation for people to take the money."
He attributed the mistake to the tax authorities' "lack of basic understanding of virtual assets" — a systemic problem as governments worldwide seize increasing amounts of cryptocurrency without adequate training in crypto OPSEC.
The failures were cascading:
- No OPSEC review of press release materials before publication
- No redaction process for images containing sensitive information
- No multi-signature wallet setup for seized assets
- No air-gapped handling procedures for high-value crypto evidence
MITRE ATT&CK Mapping
| Technique | Application |
|---|---|
| T1552.001 - Credentials in Files | Seed phrase visible in published image |
| T1078 - Valid Accounts | Seed phrase used as valid credential to access wallet |
| T1005 - Data from Local System | Sensitive data captured via photograph |
| T1537 - Transfer to Cloud Account | On-chain transfer of stolen assets |
Lessons for Organizations Handling Crypto
- Never photograph or digitize seed phrases — treat them like nuclear launch codes
- Store seed phrases in tamper-evident physical safes — not on paper near the device
- Use multi-signature wallets for seized or institutional assets — require 2-of-3 or 3-of-5 signers
- Implement media review processes — all press materials must be screened for sensitive data
- Train law enforcement on crypto OPSEC — basic crypto security should be mandatory for asset seizure teams
- Consider custodial solutions — specialized crypto custody services for government-seized assets
- Use hardware wallets with additional passphrase (25th word) — even if seed is exposed, funds remain protected
The Bigger Picture
Governments worldwide are seizing record amounts of cryptocurrency. The U.S. DOJ alone has seized billions in crypto from ransomware operators, darknet markets, and sanctions violators. But most law enforcement agencies still lack basic crypto security training.
This incident cost South Korea's national treasury $4.8 million — and the damage to institutional credibility is incalculable. As crypto seizures increase, proper handling isn't just good practice. It's a national security requirement.
Need help assessing your exposure? Apply to our Beta Tester Program at theinsider-x.com — limited slots available.
Sources: BleepingComputer (2026-02-28), Prof. Cho Jae-woo (Hansung University), Etherscan on-chain data
Top comments (0)