South Korea Tax Office Leaks Seed Phrases — ₱288.62M Stolen
South Korea’s National Tax Service accidentally exposed crypto wallet seed phrases in a press release photo on February 26. Hackers drained the wallets within hours, even as the agency disputes the reported theft of ₱288.62 million ($5 million).
Key Takeaway
Government crypto custody remains risky—even tax authorities fail to grasp the fundamentals of seed phrase security.
The National Tax Service (NTS) of South Korea accidentally published unredacted crypto wallet seed phrases in a press release photo on February 26. The NTS took a photo of a handwritten seed phrase next to Ledger hardware wallet USB devices during an inspection of 124 habitual tax evaders. The agency released the image unaware that it contained the 12 to 24-word recovery codes that grant anyone access to the wallets. The local newspaper Maeil Kyungjae was the first to report the breach.
Hackers drained the wallets within hours. Initial reports claimed hackers stole ₱288.62 million ($5 million) worth of cryptocurrency, though the NTS disputed that figure. Hansung University Blockchain Research Institute Director Cho Jae-woo said the tax authorities have displayed a basic lack of understanding of how cryptocurrencies work.
The NTS issued an apology statement on March 1, saying it behaved carelessly in providing the original photo to the press without recognizing sensitive information. Deputy Prime Minister and Minister of Strategy and Finance Koo Yoon-chul said the government and financial regulators would inspect the status and management of digital assets held by government and public institutions. He added Seoul would quickly establish and implement measures to prevent a recurrence.
The National Police Agency's cyberterrorism response division began a preliminary inquiry on February 27, analyzing digital asset flows with potential charges including information protection law violations and computer fraud. Cho Jae-woo speculated that a white hat hacker may have drained the wallets before malicious actors could access them, with the investigation ongoing as of February 27.
This article was written based on reporting from Dlnews.
