Police in South Korea were investigating unauthorized cryptocurrency transfers after the National Tax Service exposed a seized wallet’s recovery phrase in a photograph released during a Feb. 26, 2026, enforcement briefing.
In a March 1 statement, the NTS accepted responsibility for carelessly providing original photographs without recognizing that they contained sensitive information. The agency said it had confirmed cryptocurrency had left a tax debtor’s wallet, traced the movements using its own tracking system and requested a police investigation to help recover the assets.
The briefing concerned searches involving 124 high-value tax delinquents. The NTS said the operation resulted in seizures totaling 8.1 billion won, approximately $5.6 million at the time. That total covered seized assets across the operation, rather than cryptocurrency alone. One case involved four hardware wallet devices found in a drawer at the home of a taxpayer who owed capital gains tax.
A recovery phrase, also called a seed phrase or mnemonic, can restore access through a compatible wallet program. Possessing the phrase can allow someone to transfer cryptocurrency without having the original hardware device.
Cho Jae-woo, a professor at Hansung University and head of its Blockchain Research Institute, reported that 4 million Pre-Retogeum (PRTG) tokens had moved to an unidentified wallet. The reported transaction sequence included a small ether (ETH) deposit to cover network fees, followed by three token transfers.
The tokens’ reported market-price valuation was about $4.8 million. An NTS official said on Feb. 28 that PRTG had very low liquidity and could not readily be converted into cash, arguing that the likely financial loss was substantially smaller. Cho also described limited trading activity. The quoted valuation did not establish how much could actually be obtained through a sale.
The Korean National Police Agency’s Cyber Terror Response Division received an online report on Feb. 28 from a person who claimed to have accessed the cryptocurrency after seeing the exposed phrase and subsequently returned the assets. Police planned to examine transaction records to verify that account; the claimed return remained unconfirmed.
The NTS said it would commission an external review of its security systems, strengthen checks before releasing sensitive material, overhaul procedures for seizing, storing and selling cryptocurrency, and expand staff training.
In a separate case, Gyeonggi Bukbu Provincial Police said they had apprehended two suspects over the unauthorized transfer of 22 bitcoin held by Seoul’s Gangnam Police Precinct. The bitcoin had been taken into custody in November 2021 and was valued at approximately $1.5 million during the February 2026 investigation. Investigators alleged that a person connected to the case used a recovery phrase they already knew to restore the wallet and transfer the funds without authorization.
