Skip to main content

The $4.8M Press Release: How South Korea's Tax Agency Leaked a Seed Phrase and Got Saved by an Illiquid Token

· 10 min read
Dora Noda
Dora Noda
Software Engineer

On February 26, 2026, South Korea's National Tax Service (NTS) celebrated a major enforcement win. It had raided 124 high-value tax evaders, seizing roughly 8.1 billion won ($5.6 million) worth of digital assets. The agency proudly published a press release, complete with high-resolution photographs of the seized Ledger hardware wallets.

There was just one problem. One of those photographs showed the handwritten recovery phrase, fully unredacted, pixel-perfect, and globally broadcast.

Within hours, 4 million Pre-Retogeum (PRTG) tokens — nominally valued at $4.8 million — had been drained. Then, about 20 hours later, the attacker sent them back. Not out of remorse, but because the token's daily trading volume was $332 and unloading it was mathematically impossible. South Korea got bailed out by the very illiquidity that made the seizure economically meaningless in the first place.

The incident is funny, embarrassing, and illuminating — all at once. It's also a warning. As governments increasingly hold billions in seized crypto, the gap between enforcement ambition and custody competence has never been wider.

The Anatomy of a $4.8 Million PR Disaster​

The NTS wanted vivid proof of its enforcement muscle. Rather than crop or blur the seized Ledger devices, staff released original photos straight from the raid. One image captured a piece of paper next to a Ledger Nano — the backup phrase the target had apparently hand-written and kept alongside the device.

The agency's later apology said the quiet part out loud: "In an effort to provide more vivid information, we did not realize that sensitive information was included and carelessly provided the original photo." The translation: nobody on the press team understood that a 12-word sequence next to a Ledger is the master key, not decoration.

Within hours of publication, an unidentified attacker reconstructed the wallet. On-chain forensics show a textbook sequence:

  1. Gas prep — The attacker deposited a tiny amount of Ethereum to the seized wallet to cover transaction fees.
  2. Extraction — They moved the 4 million PRTG tokens in three carefully sized transactions to an external address.
  3. Wait — Then, nothing happened.

Because there was nothing they could do with the haul.

Why the Illiquidity Saved Korea​

PRTG, or Pre-Retogeum, is the kind of token most people have never heard of, and for good reason. It trades on exactly one centralized exchange — MEXC — and registers approximately $332 in 24-hour volume. According to CoinGecko, a sell order of just $59 would crater the price by 2%.

The math of trying to cash out $4.8 million against that liquidity is grim. Even spreading the liquidation over weeks, the attacker would have:

  • Signaled obvious theft patterns to MEXC's compliance team
  • Collapsed the price by 90%+ before meaningful volume cleared
  • Drawn instant attention from South Korean authorities already investigating

Approximately 20 hours after the initial transfer, the attacker gave up. An address tied to the "86c12" thief wallet sent all 4 million PRTG tokens back to the original addresses. The press release had exposed a master key to a vault full of monopoly money.

If the seized tokens had been Bitcoin, Ether, or a Tier-1 stablecoin, the funds would be gone. The same OpSec failure against USDT or ETH would have ended with a 10-minute Tornado Cash mix and zero recoverable assets. PRTG's terrible market was the accidental airbag.

This Is Not the First Time​

The Korean crypto-custody record has cracks that go beyond one press release. In 2021, police investigators lost 22 BTC (worth millions at current prices) from a cold wallet stored in an evidence vault. The root cause was the same: mishandled mnemonic phrases, no multi-sig policy, and a custody chain that treated crypto like any other seized object.

Two incidents, five years apart, in two different law enforcement arms of the same country. The pattern is structural, not a single bad day for the NTS press office.

And Korea is hardly alone. Law enforcement agencies worldwide now routinely seize hardware wallets during raids — and almost none of them have published internal standards for:

  • Photographing evidence without exposing recovery material
  • Transferring seized funds to government-controlled multi-sig wallets
  • Rotating custody from the original hardware to fresh keys
  • Role-based access between forensics, prosecutors, and treasury

Most agencies treat a Ledger like a smartphone. They bag it, tag it, and file it. The result is a growing systemic risk as national crypto holdings scale into the billions.

The Gap Between Enforcement and Custody Competence​

Compare the NTS incident with the U.S. Department of Justice's November 2025 seizure of $15 billion in Bitcoin — roughly 127,271 BTC — linked to the Prince Group's pig-butchering operation. That haul, the largest forfeiture in DOJ history, was executed with Chainalysis-powered tracing, coordinated international warrants, and immediate transfer to Treasury-controlled custody. Chainalysis alone has supported hundreds of government seizures, helping secure an estimated $12.6 billion in illicit crypto over a decade.

The U.S. government now holds approximately 198,012 BTC under its Strategic Bitcoin Reserve framework — roughly $18.3 billion at current prices. El Salvador holds 7,500 BTC through direct purchases. Bhutan has accumulated ~6,000 BTC via state-linked mining. Governments globally now hold more than 2.3% of all Bitcoin.

The operational gap between the DOJ's sophisticated tooling and the NTS's unblurred JPEGs is not a difference in sophistication — it's a difference in whether anyone has written the standard operating procedures yet. Many agencies are still treating crypto custody as an improv exercise.

That gap becomes existential as sovereign holdings grow. A single OpSec failure at the DOJ scale — an unredacted transaction hash, an exposed cold-storage address, a poorly rotated signer — could drain billions, not millions. And Bitcoin has no illiquidity safety net.

What Professional Custody Actually Looks Like​

The institutional custody industry has already answered the questions that tripped up the NTS. Modern sovereign and enterprise custody stacks rely on:

  • Multi-sig with MPC — A 3-of-5 threshold where each key share is itself protected by multi-party computation. No single signer, device, or compromised employee can move funds. The complete private key never exists in one place.
  • Air-gapped cold storage — Seized assets are immediately swept to wallets whose private keys have never touched an internet-connected device. The original hardware becomes evidence, not an active hot signer.
  • Role separation — Forensics handles custody, prosecutors handle paperwork, and a designated treasury function signs transactions. No one role holds both the keys and the narrative.
  • Evidence-safe documentation — Photographs of seized devices are redacted at the camera, not the editorial review. Standard operating procedures assume any image with a wallet will eventually leak.

None of this is exotic. Firms like Anchorage, BitGo, Fireblocks, and a growing roster of MPC-based custodians offer government-tier solutions off the shelf. The technology is not the bottleneck. Institutional discipline is.

The Lessons That Will Outlive This Headline​

The NTS incident is funny because it ended well. But it contains four lessons that regulators, enforcement agencies, and crypto-native institutions should internalize now, while the stakes are still measured in millions rather than tens of billions.

1. Standard operating procedures must assume photographic evidence leaks. Any raid image containing a hardware wallet should default to redaction or exclusion. Communications teams should not be the last line of defense on cryptographic secrets.

2. Seized crypto must be rotated immediately. The moment assets are recovered, they should be moved to a government-controlled multi-sig wallet with fresh keys. The original hardware becomes evidence — it should never remain an active custody device once the raid is on the record.

3. Illiquidity is not a security strategy. Korea got lucky because PRTG was un-dumpable. The next leaked seed phrase will reveal a wallet full of ETH, USDC, or SOL, and no amount of market depth will claw those funds back.

4. Crypto enforcement training needs the same rigor as evidence-handling training. Officers photographing a seized vehicle don't accidentally release the VIN + registration keys to the public. The equivalent discipline for hardware wallets does not yet exist in most agencies.

Infrastructure for the Post-Amateur Era​

As governments move from seizing crypto to holding it as sovereign reserves, the entire ecosystem — not just enforcement agencies — has to level up. Tax authorities, court systems, and national treasuries need institutional-grade infrastructure: reliable multi-chain data access to monitor seized addresses, high-availability node services for transaction submission, and audit-grade APIs that produce defensible chain-of-custody records.

BlockEden.xyz provides enterprise-grade blockchain API infrastructure across 27+ chains, purpose-built for the compliance and reliability demands of institutional custody. Explore our API marketplace if you're building the tools that help serious custodians avoid becoming the next illustrative headline.

The Next One Will Be Worse​

The NTS seed-phrase leak will be remembered as the funny one — the incident where a token no one had heard of protected a government from its own PR team. The next one won't have that luxury.

As sovereign Bitcoin reserves grow, as tokenized assets migrate to public chains, and as enforcement seizures become routine line items rather than career-defining busts, the compounding exposure to a single OpSec mistake becomes enormous. Every photographer, every intern, every well-meaning press officer is now a potential vector for a nine-figure drain.

The irony is that the cryptography is not the problem. Ledger did its job. Ethereum did its job. The blockchain faithfully executed the transfer of 4 million tokens to a stranger, exactly as the signer instructed. The failure was entirely human — a press team treating a 12-word phrase as photographic decoration.

Crypto doesn't need better wallets. It needs better habits. And in 2026, with governments holding 2.3% of all Bitcoin and billions in other digital assets, the margin for learning those habits in public is rapidly closing.

Sources:

Share on Twitter