Loading story…
South Korea’s National Tax Service (NTS) inadvertently exposed the mnemonic recovery (seed) phrase for a seized Ledger hardware wallet by publishing unredacted photos in an official press release about a tax enforcement operation targeting high-value tax evaders. Because the seed phrase functions as the master key to restore and control the wallet, the disclosure enabled an unknown actor to take full control of the seized crypto assets and move them off-wallet, turning a law-enforcement seizure into an immediate loss for the public treasury.
On-chain activity described in reporting indicates the attacker first sent a small amount of Ethereum (ETH) to the compromised wallet to cover gas fees, then transferred 4 million Pre-Retogeum (PRTG) tokens—valued at roughly $4.8M at the time—out to a new address in three transactions. The incident has been characterized by observers as a basic operational security failure in government handling of virtual assets, underscoring the need for strict redaction and custody procedures when documenting or publicizing seized cryptocurrency evidence.
See attribution, scope, and your downstream exposure.
5 events from the most recent confirmed update back to the earliest known activity.
The NTS publicly apologized for exposing the wallet seed phrase and said it had asked Korea’s National Police Agency to trace the unknown perpetrator or perpetrators. The agency also said it had strengthened internal controls and revised procedures for seizing, storing, and disposing of virtual assets, with staff training to follow.
After the seed phrase exposure and resulting theft became apparent, the NTS took down the original press release from its website. The removal was cited across reports as part of the agency’s immediate response to the incident.
Within hours of the publication, an unknown actor used the exposed seed phrase to restore access to the wallet, funded transactions with a small amount of ETH, and transferred out about 4 million Pre-Retogeum tokens worth roughly $4.8 million. Reports describe the theft as occurring in the early hours of February 27 via multiple outbound transactions.
On February 26, 2026, the NTS published a press release with high-resolution photos of seized assets that included an unredacted handwritten mnemonic recovery phrase for a confiscated Ledger hardware wallet. The disclosure effectively exposed the wallet’s master key to the public.
South Korea’s National Tax Service carried out an enforcement operation against 124 high-value tax delinquents and seized assets including cryptocurrency. The confiscated haul was reported at about ₩8.1 billion, including a Ledger wallet holding millions of PRTG tokens.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
7 references tracked. Mallory keeps watching after this page renders.
tomshardware.com
Open sourcebitdefender.com
Open sourcescworld.com
Open sourcego.theregister.com
Open sourcedatabreaches.net
Open sourcerescana.com
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
US authorities arrested **John Daghita** (online handle **“Lick”**) in Saint Martin for allegedly stealing **more than $46 million** in cryptocurrency tied to the **U.S. Marshals Service (USMS)**. The arrest was conducted in a joint operation between the **FBI** and France’s **Groupe d’Intervention de la Gendarmerie Nationale (GIGN)**, and reportedly involved the seizure of cash, hard drives, and security keys. Reporting links Daghita to a USMS digital-asset management contractor (CMDSS), and notes that blockchain investigator **ZachXBT** publicly traced USMS-linked wallet movements to addresses he associated with Daghita, helping bring attention to the alleged theft. Separately, South Korea’s **National Tax Service** reportedly lost roughly **$5 million** in seized cryptocurrency after officials circulated a press release that exposed a wallet’s **mnemonic recovery phrase/password**, enabling an unknown party to drain the funds. The incident was described as part of a broader pattern of **crypto custody lapses** in South Korean law enforcement, with additional cases cited involving missing seized bitcoin and investigations tied to potential phishing and internal control failures. Together, the incidents underscore that government-held digital assets remain a high-value target and that operational security failures (credential exposure, weak key management, and inadequate redaction/review processes) can directly translate into rapid, irreversible losses.
Jun 29, 2026
South Korean police arrested two suspects over the alleged embezzlement of **22 BTC (~$1.5M)** that had been held in police custody after a virtual asset company turned over a cold wallet during a 2021 hacking investigation. Reporting indicates required procedures to move seized crypto into a police-controlled cold wallet and vault were not followed; instead, the original third party retained control elements and later allegedly provided a **mnemonic seed phrase** to a hacker as part of a purported “loan” arrangement, enabling the attacker to recover the wallet and transfer the funds without police detection. The theft was reportedly uncovered during a National Police Agency audit triggered by a separate January 2026 incident in which **320 BTC** went missing from the Gwangju District Prosecutors’ Office. Separately, the U.S. Department of Justice announced the seizure of **$61 million in USDT (Tether)** tied to **“pig butchering”** cryptocurrency investment scams, stating the funds were traced to addresses used to launder proceeds stolen from victims. The DoJ described typical scam mechanics involving social engineering via dating/social messaging apps, coercion of trafficked workers in Southeast Asia–based scam compounds, and fraudulent investment platforms that display fabricated returns and impose additional “fees” when victims attempt withdrawals, with law enforcement emphasizing cross-border tracing and disruption of laundering infrastructure.
Jun 29, 2026
Rapid7 uncovered an active cryptocurrency fraud operation, tracked as **Operation ASTERIX**, after finding an exposed attacker server containing phone-number datasets, account-validation tools, phishing panels, Asterisk-based dialing infrastructure, and counterfeit wallet applications impersonating **Trezor**, **Ledger**, and **Exodus**. The campaign validated more than 100,000 phone numbers against cryptocurrency services including **Crypto.com** and **Kraken**, enriched confirmed leads with personal details, and then used coordinated phishing emails and vishing calls to direct victims to fake wallet software or recovery-phrase entry pages. The malware and infrastructure were built to steal wallet seed phrases and other victim data, with artifacts showing Telegram bot exfiltration, deceptive domains, trojanized installers, and macOS persistence via LaunchAgents. Rapid7 said the fake Trezor malware used Electron, process replacement, hidden windows, and local logging, while a trojanized **Claude Code** installer secretly deployed a fake **Ledger Live** payload alongside the legitimate tool to reduce suspicion. Recovered logs also showed the operator relied heavily on AI coding assistants including **GitHub Copilot**, **Claude Code**, and **Kimi** to develop, obfuscate, and host components of the scam infrastructure.
Aug 18, 2026