-1.86%
-3.62%
-2.01%
-2.33%
+6.92%
-5.92%
South Korean police have arrested one suspect in connection with the theft of cryptocurrency from digital wallets belonging to the country’s National Tax Service (NTS). The incident occurred after the agency inadvertently exposed a master key in a press release in late 2025, and authorities are now tracking a second individual involved in the breach.
According to the National Police Agency on , its Cyber Terror Investigation Unit apprehended a suspect in his 40s on . The arrest followed a referral from the NTS in December after it discovered digital assets had been stolen. The initial suspect reportedly sent a confession letter, stating he took it but returned it and is reflecting on his actions.
However, investigators found that after the cryptocurrency was returned, it was transferred again to a different, unknown account. This prompted the search for a second suspect. We arrested the initial perpetrator in his 40s on the 1st and are tracking the second thief,
a police official stated.
The security failure originated on , when the NTS distributed a press release about seizing assets from delinquent taxpayers. The release mistakenly included a mnemonic code, a sequence of words that acts as a master key for recovering a cryptocurrency wallet. The stolen assets were reportedly 4 million PRTG tokens, valued at approximately $4.8 million (6.9 billion won).
However, sources note the actual financial damage may be minimal. Analysts claim the PRTG tokens have no trading activity, making them virtually impossible to convert into cash. The exposed key was for one of four cold wallet USBs the NTS had seized.
The initial suspect who confessed claimed his motive was simple curiosity. He reportedly told investigators he attempted the theft after seeing an internet post pointing out that the NTS had publicly exposed its mnemonic code. According to his confession, he returned the assets the following day before they were subsequently moved by another party.
The National Police Agency is actively tracking the second suspect. Separately, the agency announced plans to strengthen its internal protocols for managing seized cryptocurrency. This decision follows a different incident at Seoul’s Gangnam Police Station in 2022, where 22 bitcoins (worth approximately 2 billion won at the time) were lost due to improper handling. The new guidelines will require two designated custodians for wallet management and mandate that hardware wallets and recovery phrases be sealed during storage.
Follow Hashlytics on Bluesky, LinkedIn , Telegram and X to Get Instant Updates
