South Korea Sells $21.5 Million in Recovered Bitcoin After Custody Breach
In a significant move, South Korean authorities sold 320.8 Bitcoin (BTC), worth approximately $21.5 million, which they recovered from a phishing incident that had previously compromised the cryptocurrency’s custody. The Gwangju District Prosecutors’ Office confirmed that the sale occurred in small increments over 11 days, from February 24 to March 6, 2026, strategically organized to minimize disruption in the market.
Context
This Bitcoin belonged to a case involving a suspect alleged to have operated an illegal gambling website, which purportedly processed around 390 billion won, equivalent to about $285 million, in wagers from 2018 to 2021. In August 2025, during a vulnerable custody handover, the asset management team fell victim to a phishing scheme that led to the loss of the cryptocurrency. Authorities successfully traced the stolen funds to a hacker’s wallet, prompting swift action.
In response to the breach, officials from the Gwangju District Prosecutors’ Office worked with both domestic and international cryptocurrency exchanges to freeze the hacker’s wallet address, making it nearly impossible for the perpetrator to liquidate the funds. On February 17, 2026, the authorities regained control of the Bitcoin, which had been returned to a government-managed wallet. Remarkably, just two days later, the hacker returned 320.88 BTC, which were then promptly moved to a secure exchange wallet under governmental control.
Key Details
The Gwangju District Prosecutors’ Office verified that the 320.8 BTC were sold at prevailing market prices, culminating in a total transfer of 31.59 billion Korean won, approximately $21.5 million, to the national treasury. The decision to sell in phases over 11 days allowed authorities to navigate the complex dynamics of the cryptocurrency market without triggering significant fluctuations.
This incident exemplifies the intersection of law enforcement and digital finance, highlighting the vulnerabilities associated with cryptocurrency custody. The illegal gambling website linked to the Bitcoin serves as a cautionary tale, illustrating how easily illicit activities can jeopardize digital assets. The phishing attack that occurred in August 2025 raised alarms about the security protocols in place for protecting such valuable assets, prompting a reassessment of best practices in cryptocurrency management.
Implications
The custody breach and subsequent recovery of Bitcoin bring to light the substantial challenges South Korean authorities encounter in safeguarding digital assets. In January 2026, the National Tax Service (NTS) issued a warning indicating that crypto assets, even those stored in cold wallets, could be subject to seizure in cases of suspected tax evasion. An NTS official stated, “We analyze tax delinquents’ coin transaction history through crypto-tracking programs, and if there is suspicion of offline concealment, we will conduct home searches and seizures.”
Additionally, in December 2025, the Financial Services Commission (FSC) unveiled proposals for imposing stringent bank-level, no-fault liability regulations on cryptocurrency exchanges. This initiative aims to hold crypto exchanges accountable to the same standards as traditional financial institutions, thereby bolstering consumer protection and addressing security vulnerabilities within the crypto sector.
Outlook
The recovery and subsequent sale of the Bitcoin underscore the active efforts by South Korean authorities to enhance digital asset security and navigate regulatory hurdles. This incident may serve as a catalyst for further legislative actions aimed at improving the management and protection of cryptocurrencies in South Korea. Stakeholders should remain vigilant as discussions progress regarding potential revisions to the Electronic Financial Transactions Act and the introduction of more stringent IT security requirements for cryptocurrency exchanges. With developments in this space continuing to evolve, the landscape of digital asset security remains a critical area to watch.