Someone at South Korea’s National Tax Service photographed a seized Ledger hardware wallet next to a handwritten sheet of paper containing its full mnemonic recovery phrase, then published that photograph in an official press release.
Within 10 hours, $4.8 million in digital assets was gone.
What Happened
The NTS released a press statement detailing seizures from 124 high-value tax delinquents. The photo was meant to illustrate the scale of the operation. What it inadvertently showed was the complete seed phrase for one of the seized wallets, every word, unmasked, visible to anyone who looked closely enough.
A recovery phrase is a master key. Physical device, password, two-factor authentication, none of it matters once someone has those words in the correct order. On-chain monitors recorded the unauthorized transfer of 4 million PRTG tokens to an anonymous address within the same day the release went live. The NTS has since said it is “checking” the situation. No further details have been offered.
Blockchain experts and university professors described it as a preventable security failure, which it was, in the most literal sense possible. The credentials were in the photograph because someone put them there.
Part of a Longer Pattern
The frustrating context here is that this isn’t an isolated lapse. South Korean authorities have been losing seized crypto with remarkable consistency.
In January 2026, Gwangju prosecutors were investigated over a $48 million loss of seized Bitcoin linked to a phishing incident. In February, Seoul’s Gangnam Police Station confirmed that 22 BTC, held in evidence since 2021, had gone missing from a cold wallet. Now this.
Three separate custody failures across two months, totaling well over $50 million. The NTS incident is perhaps the most embarrassing of the three, because it required no sophisticated attack. It required only a photograph and a press release.
