NTS’s Seed Phrase Photo: A Masterclass in Digital Security

by

South Korea’s National Tax Service (NTS) accidentally published a cryptocurrency wallet’s recovery phrase in a Feb. 26 press release, enabling the temporary transfer of roughly $4.8 million in seized tokens before the assets were returned hours later.

NTS Press Release Leak Leads to $4.8M Token Transfer in Seoul

South Korea’s NTS disclosed a cryptocurrency wallet’s mnemonic recovery phrase in an unredacted photograph attached to a Feb. 26, 2026, press release, allowing an unknown party to access and transfer millions of seized tokens before they were later returned. Because nothing says “secure” like printing your vault key on a public press release, right?

Source: South Korea’s Maeil Business Newspaper

The NTS announcement detailed the seizure of assets worth 8.1 billion won, or about $5.6 million, from 124 high-value tax delinquents. Among the confiscated property were hardware wallets recovered from a taxpayer’s residence. A photograph included in the release showed a Ledger device next to a handwritten 12- or 24-word mnemonic phrase. The phrase was fully visible and not blurred. Because of course they were-why redact something that’s basically a universal key to your digital piggy bank?

A mnemonic phrase, often called a seed phrase, allows anyone in possession of it to regenerate the wallet and control its funds without the original hardware. By publishing the phrase online, the NTS effectively exposed full access credentials to the seized wallet. Classic. Like leaving your front door unlocked and then being surprised when someone walks in.

Blockchain records reviewed on Etherscan and Arkham show that in the early hours of Feb. 27, an unidentified actor deposited a small amount of Ethereum to cover transaction fees and then transferred 4 million Pre-Retogeum (PRTG) tokens to a new address. The tokens carried a nominal valuation of about $4.8 million at the time. Because why not? It’s not like PRTG is a liquid asset or anything.

Market data indicates that PRTG is extremely illiquid, with daily trading volume around $332 and listing on a single exchange, MEXC. Offloading such a large quantity of PRTG would likely have been difficult without sharply affecting the price. Imagine trying to sell a rare Pokémon card in a Walmart parking lot. Chaos ensues.

Roughly 20 hours after the transfers, onchain records show the full 4 million PRTG tokens were returned to the original wallet. While the immediate financial loss was mitigated, the wallet’s recovery phrase remains compromised, meaning any continued use would require migration to a newly secured address. But hey, at least they didn’t lose the entire $5.6 million!

Everyone on social media criticized the incident as a basic operational failure. They described publishing a seed phrase in a public document as equivalent to advertising unrestricted access to digital funds. The breach also marks the third reported lapse involving seized cryptocurrency custody by South Korean authorities in recent months. One wonders if the NTS has considered hiring a cybersecurity consultant-like, you know, someone who isn’t a tax auditor.

The episode has intensified scrutiny of institutional crypto handling practices in South Korea, particularly as regulators advance measures such as the Crypto Travel Rule. Observers say the incident demonstrates that enforcement efforts involving digital assets require specialized training and strict custody protocols to prevent similar exposures. Or, you know, just not putting your secret key in a photo.

FAQ 🔎

  • What did South Korea’s tax service disclose?
    It published an unredacted wallet recovery phrase in a Feb. 26 press release.
  • How much crypto was moved?
    About 4 million PRTG tokens, nominally valued near $4.8 million.
  • Were the tokens permanently lost?
    No, onchain records show they were returned roughly 20 hours later. But the wallet’s probably haunted now.
  • Why is this significant?
    It highlights security gaps in government handling of seized digital assets. Also, it’s a reminder that even governments can’t spell “discretion.”

Read More

2026-02-28 23:58