"NTS-seized crypto found stolen twice… fallout after mnemonic code exposure"

Crypto assets (cryptocurrency) seized by Korea’s National Tax Service (NTS) are reported to have been leaked externally on two separate occasions. With the withdrawal password—known as a “mnemonic code”—left exposed in a press release, the theft appears to have been possible via remote access.

According to industry sources on the 2nd, the NTS distributed a press release on the 26th of last month stating that it had seized a cold wallet (a USB-type wallet) holding crypto assets belonging to a high-value delinquent taxpayer. In the process, a photo containing the wallet’s mnemonic code was reportedly made public.

A mnemonic code is effectively a “master key” that can be used to recover and withdraw assets from a crypto wallet. With the code alone, one can access the assets even without the physical wallet.

Subsequently, one user is believed to have used the code to transfer 4 million PRTG coins stored in the seized wallet to an external wallet. The coins were returned to the original wallet just two days after media reports.

A person identifying themselves as the “first thief” reportedly claimed in a written confession sent to the media that “there was no special hacking technique,” asserting in effect that they “took it and then returned it.” The same confession was also reportedly submitted to police.

However, additional confirmation showed that about 2 hours and 30 minutes after the return, the same amount was moved again to another wallet—effectively indicating a second theft.

Police are investigating the credibility of the first thief’s claims while tracking the transfer trail of the coins leaked in the second incident. The case is once again highlighting the need to review security checks for public-sector crypto custody and management systems.