South Korean prosecutors sell seized Bitcoin for $21.5M

South Korean prosecutors have converted a cache of seized Bitcoin into cash for the state treasury after the cryptocurrency was unexpectedly returned following a phishing-related security breach.

According to multiple local media reports, the Gwangju District Prosecutors’ Office sold 320.8 BTC at prevailing market prices and transferred about 31.6 billion Korean won, roughly $21.5 million, to the national treasury. 

The liquidation took place gradually over eleven days between February 24 and March 6, with authorities reportedly splitting the sales into smaller batches to avoid disrupting the market.

The Bitcoin were originally confiscated during an investigation into an illegal online gambling platform that operated between 2018 and 2021.

In August 2025, officials responsible for managing the confiscated assets were reportedly tricked by a phishing website that mimicked a legitimate service. 

During what was believed to be a routine audit, an officer inadvertently entered the wallet’s private recovery credentials into the fraudulent site, which allowed the attacker to drain the entire balance of 320.8 BTC. 

Authorities did not immediately detect the breach, and the disappearance of the funds was only discovered months later during an internal review of seized financial holdings.

Investigators traced the stolen cryptocurrency to a hacker-controlled address and asked domestic and overseas exchanges to freeze the wallet, limiting the attacker’s ability to liquidate the funds. 

In an unexpected turn, the hacker sent back the full amount of Bitcoin in February.

Prosecutors then moved the assets to a secure exchange wallet and began selling them shortly afterwards.

Although the liquidation has now returned more than $21 million to the state, the hacker responsible for the breach remains unidentified, and the investigation continues.

The episode has intensified scrutiny of how South Korean authorities manage confiscated digital assets, particularly as similar incidents have surfaced across other agencies.

A nationwide audit following the Gwangju breach revealed that Seoul’s Gangnam Police Station had also lost 22 BTC seized in 2021. 

Unlike the phishing attack in Gwangju, that case involved a breakdown in evidence handling procedures. 

Officers had left the cryptocurrency in a cold wallet originally provided by the suspects without changing the access credentials. 

The wallet itself was never stolen, and investigators are examining the possibility of internal involvement.

Another incident drew public criticism after the National Tax Service inadvertently exposed a cryptocurrency wallet recovery phrase during a press report. 

Security lapses trigger review

Repeated lapses have raised concerns about the technical readiness of law enforcement agencies tasked with safeguarding large cryptocurrency holdings.

South Korea’s finance minister has since pledged reforms aimed at tightening oversight of digital assets held by government agencies. 

In a statement posted on social media, the minister said authorities will work with the Financial Services Commission and the Financial Supervisory Service to conduct a comprehensive inspection of cryptocurrency holdings acquired through legal enforcement actions such as tax seizures.

The review will examine how confiscated digital assets are stored, who has access to private keys, and how different agencies coordinate custody procedures. 

Officials said the process will also introduce stronger security controls to prevent similar incidents in the future.