$4.8M Stolen After South Korean Tax Agency Publishes Crypto Recovery Phrase

South Korean authorities are facing scrutiny after a tax office mistakenly leaked a cryptocurrency wallet recovery phrase to the public, enabling unknown actors to steal approximately $4.8 million in PRTG tokens.

According to multiple reports, the country’s National Tax Service (NTS) inadvertently made public a document containing the mnemonic phrase tied to a government-controlled crypto wallet. The document was included in a press release issued on February 26, 2026. That phrase, effectively the master key to the wallet, was later used to transfer out the funds.

The incident highlights growing operational risks as governments increasingly seize, store, and manage digital assets.

How the Wallet Was Compromised

At the center of the incident was a crypto wallet holding assets previously confiscated as part of a tax enforcement action. Authorities had reportedly published press materials, including a photo of documentation that included sensitive wallet information.

Among the disclosed details was the wallet’s recovery phrase, a sequence of words that allows full access and control over cryptocurrency holdings. Once exposed, anyone with the phrase could recreate the wallet and move the funds without additional authentication.

Shortly after publication, blockchain data showed transfers from those wallets. At the time of the incident, the total value of the drained assets was estimated at roughly $4.8 million.

Because blockchain transactions are irreversible, the funds cannot simply be retrieved once transferred, unless the recipient voluntarily returns them or law enforcement identifies and freezes the assets on an exchange.

>>> Read more: Inside the I-Soon data leak – China’s Cyber Warfare Tactics

Why Seed Phrase Exposure Is Critical

A crypto wallet’s seed phrase functions differently from a typical password. While many online accounts offer multi-factor authentication or account recovery options, a mnemonic phrase provides direct, unrestricted access to funds.

In practical terms, publishing such a phrase is equivalent to publicly sharing the private keys to a vault containing digital assets.

The South Korean tax office leak underscores how digital asset custody requires different security standards than traditional financial asset management. Unlike bank accounts, crypto wallets do not rely on centralized intermediaries that can reverse unauthorized transfers.

For government agencies handling seized crypto, this presents unique challenges. Secure storage typically involves cold wallets, multi-signature authorization systems, and strict internal access controls. Any lapse, especially public disclosure, can immediately compromise assets.

Accountability and Security Questions

The National Tax Service has reportedly removed the exposed information, but the damage was already done. It remains unclear how long the recovery phrase was accessible before the funds were drained.

The incident raises broader questions about how public institutions manage digital asset evidence. As enforcement agencies around the world increase crypto seizures tied to tax violations, fraud, and other crimes, custody infrastructure becomes a critical operational component.

This accidental leak at the South Korean tax office may prompt reviews of internal procedures governing how confiscated crypto is stored, documented, and disclosed in public records. Even routine transparency measures can carry unintended consequences when they involve digital keys.

So far, there has been no public confirmation that the stolen funds have been recovered. Blockchain analytics may help trace asset movements as of late February 2026, but identifying the individuals behind wallet transfers remains complex unless funds pass through regulated platforms.

>>> Read more: South Korea Crypto Tax Crackdown Targets Cold Wallets

A Broader Signal for Government Crypto Handling

This episode serves as a reminder that digital assets operate under fundamentally different security assumptions than traditional finance. Control of a private key or seed phrase equals control of the funds, without recourse.

For governments that have increasingly positioned themselves as regulators of crypto markets, operational competence in handling seized assets is becoming part of the credibility equation.

As crypto adoption expands globally, public-sector institutions may need to invest more heavily in digital asset security expertise. The consequences of mistakes are immediate and, as this case shows, financially significant.

While investigations may clarify how the exposure occurred, the broader takeaway is already clear: in crypto custody, even a single disclosure can result in irreversible loss.