South Korean prosecutors have recovered approximately $21 million in stolen Bitcoin after the hacker responsible returned the funds.
The incident stemmed from a phishing-related breach that compromised crypto assets under official custody.
The Bitcoin, valued at roughly 21.4 billion won, had originally been seized from a gambling platform raid and was being held by the Gwangju District Prosecutors’ Office.
How the Hack Happened
The breach occurred in August 2025 when investigators mistakenly accessed a phishing website and entered the recovery seed phrase for a wallet holding confiscated assets. That single error allowed the attacker to gain full control of the wallet.
The compromised funds totaled approximately 320 BTC. Once the theft was discovered, authorities moved quickly to limit the damage.
How the Funds Were Recovered
The recovery was made possible after South Korean authorities blocked transactions involving the stolen Bitcoin on centralized exchanges. By preventing the hacker from liquidating the assets into fiat or stablecoins, prosecutors effectively cornered the attacker.
Following the freeze on exchange activity, the hacker returned the funds to wallets controlled by prosecutors.
However, blockchain forensic reports indicated that shortly after the 320 BTC were restored, the funds were transferred again to a new address. That movement has triggered additional internal review and raised questions about post-recovery custody handling.
As of now, the identity of the hacker remains unknown.
Broader Custody Concerns in South Korea
The case comes amid a series of digital asset security challenges for South Korean authorities in early 2026.
In February, police reported a separate loss of 22 BTC, worth approximately $1.5 million, from seized criminal assets due to custody failures. Around the same time, major exchange Bithumb mistakenly distributed over $40 billion in Bitcoin because of a promotional input error, though it managed to recover 99.7% of the funds.
Taken together, these incidents have intensified scrutiny over digital asset custody practices in both public institutions and private exchanges.
The Gwangju District Prosecutors’ Office is now reviewing its internal security protocols, particularly around seed phrase management and phishing protection, as authorities work to prevent similar breaches in the future.
