In January 2026, the Gwangju District Prosecutors’ Office launched an internal investigation and audit after discovering that 320 BTC valued at around $28-29 million USD at the time, or about 40-41 billion KRW had been lost/stolen from custody.
This occurred during an internal handover process in August 2025, with indications it may have involved a phishing attack or other compromise while managing seized criminal assets. Prosecutors stated they would pursue recovery and potential criminal liability if wrongdoing is found.
More recently, Seoul’s Gangnam Police Station confirmed the loss of 22 BTC worth approximately 2.1 billion KRW or ~$1.6 million USD from evidence storage. These coins were voluntarily submitted in a 2021 investigation later suspended, and the disappearance was uncovered during a nationwide audit and inspection of seized virtual asset handling procedures triggered by the earlier Gwangju case.
Register for Tekedia Mini-MBA edition 19 (Feb 9 – May 2, 2026).
Register for Tekedia AI in Business Masterclass.
Join Tekedia Capital Syndicate and co-invest in great global startups.
Register for Tekedia AI Lab.
An internal probe is underway to determine how the unauthorized transfer occurred, including possible insider involvement. The physical cold wallet remains in possession, but the BTC was transferred out. Adding these up (320 BTC + 22 BTC = 342 BTC), this closely matches the “over 340 BTC” figure across multiple cases/institutions (prosecutors and police).
These incidents have prompted broader scrutiny of how South Korean authorities secure and manage confiscated cryptocurrencies from criminal investigations, amid concerns over storage practices, phishing risks, and potential internal lapses.
Note that this is separate from the high-profile February 2026 Bithumb exchange incident, where a staff error caused ~620,000 BTC worth ~$40-44 billion to be accidentally credited to users in a promotion gone wrong (a “fat-finger” input of BTC instead of KRW).
That led to its own regulatory probe by the Financial Supervisory Service (FSS), on-site inspections, and industry-wide reviews—but it involved an exchange, not government authorities losing seized assets. These government-related losses highlight ongoing challenges in handling digital assets as evidence in South Korea, even as the country advances crypto regulations and legalization efforts.
Authorities have emphasized thorough investigations and recovery attempts in statements. The combined value at the time of discovery was roughly $30-48 million USD depending on exact BTC price fluctuations around January-February 2026, with BTC hovering near $66,000-$70,000.
These were seized criminal assets intended for potential forfeiture to the national treasury or victim restitution after convictions. Their loss represents a direct hit to public funds and investigative outcomes. Recovery efforts are ongoing, but success is uncertain due to the nature of transfers post-phishing or unauthorized access.
In one instance, funds were traced but remained unmoved in a wallet, complicating legal claims. The Gwangju case (320 BTC) stemmed from a phishing attack during an internal handover or routine inspection in mid-2025, where staff likely accessed a fake site, leaking credentials or private keys from a hardware wallet/USB storage.
The Gangnam Police case (22 BTC) involved unauthorized transfers from a cold wallet (physical device intact but compromised digitally), uncovered only during a nationwide audit triggered by the prior incident. The 2021 case had been suspended, delaying detection.
These highlight systemic issues: reliance on basic hardware storage without advanced multi-signature, institutional-grade security, air-gapped procedures, or automated monitoring. Even state agencies fall to common threats like social engineering and credential compromise.
Incidents undermine confidence in law enforcement and prosecutors’ ability to securely manage seized digital assets, especially as crypto seizures increase following Supreme Court rulings. If authorities can’t safeguard confiscated crypto, questions arise about protecting citizens’ assets in regulated environments or during enforcement actions.
Broader scrutiny of evidence handling could complicate future criminal cases involving crypto, potentially affecting convictions or asset forfeiture. These events have prompted nationwide audits of seized virtual asset procedures by police and prosecutors, likely leading to mandated upgrades; better training, multi-factor protocols, third-party custody solutions, or institutional wallets.
They coincide with South Korea’s push toward fuller crypto legalization and integration, lifting bans on public company crypto investments, recognizing blockchain securities, and advancing spot ETFs/stablecoins. Ironically, while exchanges face probes; government mishandling adds pressure for uniform standards across public and private sectors.
Potential acceleration of the Digital Asset Basic Act or related laws, emphasizing IT security for state-held crypto, AML compliance, and institutional custody best practices. Reinforces the mantra “Not your keys, not your coins” — even for governments. Centralized custody introduces single points of failure.
Highlights phishing as a persistent threat, even against sophisticated entities, underscoring needs for education, hardware isolation, and behavioral safeguards. In a country with high crypto adoption, these lapses could fuel calls for self-custody advocacy or offshore shifts if domestic handling appears unreliable.
While not catastrophic in scale compared to private sector incidents, these cases serve as a wake-up call for institutional crypto management in South Korea. They expose gaps at a pivotal time when the nation is formalizing digital asset rules, likely driving reforms to prevent recurrence and restore credibility. Authorities have emphasized thorough probes, recovery attempts, and accountability.