A Master Key Left in Plain Sight
South Korea’s National Tax Service (NTS) recently turned a high-profile tax enforcement success into a digital security disaster.
During a targeted operation against 124 habitual tax evaders, authorities proudly announced the seizure of 8.1 billion won, roughly $5.6 million, in various cryptocurrencies.
To showcase their diligence, the agency released a press package featuring photos of the evidence.
Among the images was a high-resolution shot of a Ledger hardware wallet sitting next to a handwritten note.
Source: Maeil Business Newspaper
That note contained the mnemonic recovery phrase: the master key to the entire digital fortune.
How A Single Photo Drained Millions
The mistake was instantaneous and irreversible.
Because a recovery phrase allows anyone to recreate a wallet on their own device, the NTS effectively handed the password to the world.
On 27 February 2026, blockchain data showed an unknown observer springing into action.
They first sent a small amount of Ethereum to the compromised wallet to cover "gas fees" for transactions.
Once the tank was fueled, they wiped the wallet clean, moving 4 million Pre-Retogeum (PRTG) tokens in three separate transfers.
At the time of the breach, those tokens were valued at approximately $4.8 million.
Is The Stolen Fortune Actually Spendable
While the paper value of the theft is staggering, the thief faces a significant hurdle: liquidity.
PRTG is a low-volume token, primarily traded on the MEXC exchange.
Market data suggests its 24-hour trading volume was a mere $332 at the time of the incident.
With the stolen 4 million tokens representing a massive 40% of the total supply, any attempt to sell them all at once would likely crash the price to near zero.
Experts suggest that while the "theoretically" stolen value is high, converting it into hard cash without a central authority to stop the trade is a logistical nightmare.
Why Do Experts Call This An Amateur Error
The backlash from the academic and tech sectors in South Korea has been swift.
Cho Jae-woo, a professor at Hansung University’s Blockchain Research Institute, noted that the incident showed “the tax authorities’ basic lack of understanding of virtual assets” and cost the national treasury billions in Korean won.
He further explained that publishing the phrase was "equivalent to advertising that the wallet was open for anyone to take the funds."
Echoing this sentiment, Professor Hwang Seok-jin of Dongguk University warned that photographing or digitally storing a mnemonic code is a fundamental security failure.
Hwang insisted that such phrases must remain on physical media and strictly offline, stating,
"Uploading such an image online is effectively the same as leaving the funds unprotected.”
Can The Government Recover The Lost Crypto
The outlook for recovery is grim.
Unlike traditional bank accounts, cryptocurrency lacks a central manager to "undo" a transaction.
Unless the funds move to a regulated exchange that can freeze the account, the NTS is largely powerless.
This blunder is part of a worrying pattern for South Korean law enforcement.
Only recently, the Gangnam Police Station saw 22 Bitcoin, now worth $1.5 million, drained from evidence storage after a recovery phrase reached a third party.
As the NTS sifts through the fallout of the PRTG theft, the identity of the person who spotted the photo and moved the millions remains a mystery, hidden behind the anonymity of the blockchain.