Hackers return stolen Bitcoin to South Korean prosecutors

South Korean prosecutors have regained control of more than 320 Bitcoin that had disappeared from government custody last year.

The unidentified hacker returned the stolen cryptocurrency to an official wallet this week, as reported by The Chosun Daily.

The recovered assets were valued at about $21.3 million at current prices, marking a rare case where stolen crypto was voluntarily sent back.

The incident comes amid rising concerns about how law enforcement agencies safeguard confiscated digital assets.

This follows another recent case in which Bitcoin vanished from police custody without the physical wallet being stolen.

Unexpected return

The Gwangju District Prosecutors’ Office confirmed it recovered 320.88 Bitcoin after the funds were transferred back to an official government-controlled wallet on Tuesday.

Authorities later moved the recovered cryptocurrency to a secure digital exchange wallet under their control.

The Bitcoin had originally gone missing in August 2025 while prosecutors were handling seized assets linked to an ongoing investigation.

Officials only discovered the disappearance months later, on Jan. 23, during a routine inspection of confiscated financial holdings.

Investigators concluded the theft was caused by a phishing attack that exposed wallet access credentials.

This allowed an unknown individual to transfer the Bitcoin out of official custody without physically accessing any hardware device.

Prosecutors had already contacted domestic cryptocurrency exchanges and requested that they freeze the wallet address used in the theft.

These measures limited the attacker’s ability to move or liquidate the stolen funds through regulated platforms.

Authorities did not explain why the Bitcoin was ultimately returned.

Investigation continues

Officials said recovering the cryptocurrency does not end the investigation.

Prosecutors are continuing efforts to identify and arrest the person responsible for the phishing attack and unauthorised transfer.

Authorities said they will pursue the suspect regardless of the recovery, the prosecutors’ office told Digital Asset Works.

Authorities are examining phishing websites and malicious domains connected to the breach.

Investigators are analysing technical traces linked to the compromised wallet credentials to determine how access was obtained and whether additional actors were involved.

Law enforcement agencies have indicated they remain focused on identifying the suspect regardless of the asset recovery.

The probe also includes efforts to dismantle any infrastructure used to facilitate the phishing operation.

Custody scrutiny grows

The case comes shortly after another Bitcoin custody incident involving South Korean authorities.

About 22 Bitcoins, valued at approximately $1.5 million at the time, disappeared from police custody in Seoul.

Investigators determined that the cryptocurrency was transferred externally even though the physical cold wallet storing the funds remained secure.

The Bitcoin had originally been voluntarily submitted to authorities during an investigation in November 2021.

The Gyeonggi Northern Provincial Police Agency has launched a separate investigation into that transfer to identify those responsible.

These incidents have intensified scrutiny over how government agencies manage and secure confiscated cryptocurrency.