South Korea’s National Tax Service Publishes Seed Phrase Photo, Sparks Wallet Breach

NTS Press Release Leak Leads to $4.8M Token Transfer in Seoul

South Korea’s NTS disclosed a cryptocurrency wallet’s mnemonic recovery phrase in an unredacted photograph attached to a Feb. 26, 2026, press release, allowing an unknown party to access and transfer millions of seized tokens before they were later returned.

The NTS announcement detailed the seizure of assets worth 8.1 billion won, or about $5.6 million, from 124 high-value tax delinquents. Among the confiscated property were hardware wallets recovered from a taxpayer’s residence. A photograph included in the release showed a Ledger device next to a handwritten 12- or 24-word mnemonic phrase. The phrase was fully visible and not blurred.

A mnemonic phrase, often called a seed phrase, allows anyone in possession of it to regenerate the wallet and control its funds without the original hardware. By publishing the phrase online, the NTS effectively exposed full access credentials to the seized wallet.

Blockchain records reviewed on Etherscan and Arkham show that in the early hours of Feb. 27, an unidentified actor deposited a small amount of Ethereum to cover transaction fees and then transferred 4 million Pre-Retogeum (PRTG) tokens to a new address. The tokens carried a nominal valuation of about $4.8 million at the time.

Market data indicates that PRTG is extremely illiquid, with daily trading volume around $332 and listing on a single exchange, MEXC. Offloading such a large quantity of PRTG would likely have been difficult without sharply affecting the price.

Roughly 20 hours after the transfers, onchain records show the full 4 million PRTG tokens were returned to the original wallet. While the immediate financial loss was mitigated, the wallet’s recovery phrase remains compromised, meaning any continued use would require migration to a newly secured address.

Everyone on social media criticized the incident as a basic operational failure. They described publishing a seed phrase in a public document as equivalent to advertising unrestricted access to digital funds. The breach also marks the third reported lapse involving seized cryptocurrency custody by South Korean authorities in recent months.

The episode has intensified scrutiny of institutional crypto handling practices in South Korea, particularly as regulators advance measures such as the Crypto Travel Rule. Observers say the incident demonstrates that enforcement efforts involving digital assets require specialized training and strict custody protocols to prevent similar exposures.

FAQ 🔎

• What did South Korea’s tax service disclose?
  It published an unredacted wallet recovery phrase in a Feb. 26 press release.
• How much crypto was moved?
  About 4 million PRTG tokens, nominally valued near $4.8 million.
• Were the tokens permanently lost?
  No, onchain records show they were returned roughly 20 hours later.
• Why is this significant?
  It highlights security gaps in government handling of seized digital assets.