South Korea’s National Tax Service is investigating the theft of approximately $4.8 million in cryptocurrency after a wallet recovery seed phrase was revealed in photographs released by the agency during a public announcement about seized digital assets.
The agency had disclosed the outcome of an enforcement action involving the confiscation of cryptocurrency. To document the operation, officials published images that showed a Ledger hardware wallet, a device commonly used to store digital assets offline. In the same photographs, a handwritten note containing the wallet’s recovery seed phrase was visible.
A recovery seed phrase is a sequence of words that allows a cryptocurrency wallet to be restored on another device. The phrase functions as the master key to the wallet. Anyone who obtains it can recreate the wallet and gain full control over the funds it holds, without requiring physical access to the original hardware device.
After the images were made public, blockchain transaction records showed that the cryptocurrency stored in the wallet was transferred to other addresses. The total value of the assets moved was estimated at about $4.8 million at the time of the withdrawal. The transfers occurred after the recovery phrase became publicly accessible through the released photographs.
Because possession of the seed phrase is sufficient to restore and control a wallet, the physical Ledger device was not needed to move the cryptocurrency. Once the phrase was exposed, control of the wallet could be established elsewhere, allowing the funds to be transferred.
The National Tax Service later removed the photographs after the issue was identified. Authorities confirmed that the cryptocurrency had been withdrawn and said an investigation had been launched into the incident. Officials have not publicly identified any suspects linked to the transfers.
The agency has not provided details about how long the photographs remained available before being taken down. It has also not disclosed whether additional safeguards will be introduced in relation to the handling, documentation, or storage of seized digital assets.