South Korean prosecutors are investigating the disappearance of a significant amount of Bitcoin that had been confiscated and held as part of a criminal case after the digital assets were reportedly stolen in a phishing attack. The Gwangju District Prosecutors’ Office discovered that tens of millions of dollars’ worth of Bitcoin was missing during a routine review of seized financial assets in late 2025 and early 2026. Authorities have said the matter is under active investigation and have declined to release specific details while the inquiry continues.
Local media reports indicate that the missing Bitcoin was estimated at roughly 70 billion won, equivalent to about $47.7 million, based on the value of the cryptocurrency at the time the discrepancy was identified. Prosecutors found that the Bitcoin, which had been held as evidence in a past criminal proceeding, was no longer accessible during a standard internal inspection. The office did not confirm exactly when the assets were seized or when they were lost, citing the sensitivity of the ongoing probe.
Preliminary findings from internal discussions suggest that the disappearance resulted from a phishing attack that exposed sensitive access credentials used to control the wallet holding the seized Bitcoin. Investigators believe the breach occurred when an employee inadvertently accessed a fraudulent website designed to mimic a legitimate service, capturing login information or private key data. Once these credentials were compromised, attackers could transfer the cryptocurrency out of official custody without triggering immediate detection.
Phishing attacks are a common technique in the cryptocurrency sector, where malicious actors create fake websites or send deceptive links that appear authentic to trick individuals into revealing sensitive information. In the context of digital asset custody, exposure of private keys or passwords can allow anyone possessing them to transfer funds irreversibly on the blockchain.
Authorities have emphasised that the investigation is ongoing and that details about the original seizure and the precise mechanisms of the loss have not been fully disclosed. Prosecutors told local news outlets that they are working to trace the funds and understand how the phishing incident occurred, but they have not provided a timeline for when the investigation might conclude.
The case has drawn attention to the technical and procedural challenges that law enforcement agencies face when managing and securing seized cryptocurrency assets. Bitcoin and other digital tokens depend on secure key management rather than physical custody, a model that differs from traditional evidence storage. Officials have suggested that internal reviews of custody practices and security protocols will be part of the ongoing investigation.
The Gwangju District Prosecutors’ Office has not confirmed whether any law enforcement agencies or external security experts have been consulted as part of the inquiry, and additional information is expected as authorities continue their work.