On February 26, 2026, South Korea's National Tax Service (NTS) made a huge mistake when they publicly released an official press release to showcase their enforcement activities against habitual tax offenders. In this official press release, there were numerous images included that provided a complete view of the MNEMONIC SEED phrase for a crypto hardware wallet that had previously been seized by the NTS. After releasing this information publicly, an opportunistic attacker used the exposed information to quickly steal approximately $4 million dollars worth of PRTG (Pre-Retogeum) tokens from the NTS's seized crypto hardware wallet (approximately 6,400,000,000 Korean won at the time). In response to the incident that has been reported on by multiple crypto media sources such as CoinDesk, CryptoSlate, KuCoin Flash, and Maeil Business Newspaper, there has been considerable criticism directed towards institutional cryptocurrency custody services in South Korea. The cryptocurrency incident has highlighted the stark difference between legal law enforcement processes and the unforgiven nature of security on a blockchain that is based exclusively on cryptographic data; one image (or similar) that has not been redacted would provide full access to control over all PIN#, or ethers (or types) of cryptocurrency held by a specific private key. The event happened with extreme rapidity as demonstrated by the speed with which blockchain data indicates a small amount of ETH (approximately $0.025 - $0.026 USD) was transferred to the hacked wallet account from an unknown source (for transaction processing fees) on February 27, 2026, before there were three (3) additional outgoing transfers executed that moved the entire remaining PRTG balance from the hacked wallet account to unknown receiving wallet accounts. Given the low volume of daily trading (approximately $331 USD) of PRTG tokens, the resulting outflow of the tokens from the hacked wallet account rendered the receiving wallets unable to have enough liquidity to facilitate any potential recovery of the stolen funds. The event mentioned above is a part of an ongoing trend in South Korea where the National Tax Service (NTS) has stepped up enforcement of tax collection through aggressive methods. Since 2021, they have aggressively seized cryptocurrency from individuals who owe taxes and have collected billions of won worth of digital assets. The case at hand shows that even when assets are seized for public use, they can be lost forever due to sloppy handling.<h2>The Incident: From Seizure to Public Exposure</h2>Onsite inspections of 124 tax defaulters were performed, focusing on validating their existing high tax liability through inspection and investigation of high amounts previously due to the NTS. More than 8.1 billion KRW of assets were seized during this inspection process, including cash, real estate, and the most critical items – Four cryptocurrency hardware wallets belonging to a single recognised taxpayer who had failed to comply with tax law (Case 3). Pictures of these seized cryptocurrency hardware wallets taken during earlier inspection were also provided as evidence: The picture of the seized Ledger Hardware wallet included a picture of the handwritten mnemonic recovery phrase that is used to re-generate the private key to an address and gain access to all funds contained in compatible blockchain platforms. Unlike the restoration of the private key, the entire mnemonic recovery phrase was displayed in high resolution without any standard forms of redaction (blurring, cropping, pixelating, etc). Experts from around the cryptocurrency industry, including researchers from the Blockchain Research Institute at Hansung University lead by Professor Cho Jae-woo, were able to complete an analysis of the on-chain information tied to the recovered ledger wallet and quickly identify the wallet address. Upon conclusion of the identification of the wallet address from the mnemonic recovery phrase, the contents of the wallet were now available to anyone with access to the time stamped image provided in support of the press release. This event represents a complete and total failure of the application of “security by obscurity”.<h2>Immediate On-Chain Exploitation</h2>Standard mnemonics were used in the attack pattern: Funding for Fees - An anonymous user deposited a small amount of ETH into the victim's wallet to cover the gas fee for the Ethereum transaction, since the only tokens previously in the account were PRTG (an ERC20-like asset on Ethereum compatible networks). Rapid Draining- 3 separate transactions made within the first few hours of February 27, successfully drained all 4 million PRTG tokens from the victim's account to various untraceable wallets. The very short timeframe between each of the transactions demonstrates that the thief was either automating this process or was highly prepared/use the knowledge of an upcoming announcement to carry out the theft. Post-Theft Status: The funds are currently held in unknown wallets and are likely to be already laundered or bridged to create untraceable paths. Recovery of the funds is virtually impossible without laws addressing international cooperation or the freezing/banning of the exchanges involved. This shows clearly that once an individual has access to their private keys, there are no remaining windows of opportunity to defend against theft on the blockchain system.<img src="https://jid.rerrkvifj.com/media/customer/creatorSystem/71225760-e348-460b-933e-fb615432c0a6.jpeg">Source: Author<h2>Understanding the Stolen Asset: PRTG Tokens and Pre-Retogeum Project</h2>The PRTG token and the Pre-Retogeum project are two different entities. The PRTG token, which is also known as pre-retogeum tokens, is a form of cryptocurrency that will be used in connection with the Pre-Retogeum platform, a decentralized energy trading and distribution/consumption platform to facilitate peer-to-peer (P2P) energy through blockchain technologies. Because PRTG token transactions will be conducted between businesses and consumers in a Decentralized manner, the PRTG token will have utility value as part of the emergent marketplace for tokenized renewable energy and smart grid technologies. As of 2/26/2026, the price for one PRTG Token approximately equaled $1.20 and the market capitalization was about $12 million using 10 million PRTG Token as the value of total supply. The daily trading volume is low at about $333 per day and may have increased impact from the theft of PRTG Token because the amount stolen constituted a large portion of the available liquidity of PRTG Tokens, potentially causing price slippage during the breach. The wallet associated with the transaction contained a significant quantity of PRTG Tokens (4 million tokens, valued at $4,800,000), suggesting that any cryptocurrency can have a mid-cap or niche classification; however, when there is a large concentration of tokens, their actual value in the "real world" can be considerable. <img src="https://jid.rerrkvifj.com/media/customer/creatorSystem/ddfcbdcf-2f71-4eaa-b01d-0a94821db367.jpeg">Source: Author<h2>Broader Context: South Korea’s Aggressive Crypto Enforcement Landscape</h2>South Korea has become a trailblazer in crypto regulation and enforcement, having already established frameworks for taxing virtual assets (after repeated delays) — and having seized billions of dollars’ worth of crypto from taxpayers who owe those taxes. Between 2021 and 2025, South Korean authorities have also collected 140 billion KRW ($106 million) to 200 billion KRW ($150 million) worth of digital assets through tax-delinquency-related freezes, liquidations, and auctions. <h3>Some of the recent initiatives include:</h3>Artificial Intelligence-based systems to monitor patterns of tax evasion across more than 8 billion transactions involving cryptocurrency each year. Specialized units dedicated to ensuring compliance with regulations governing virtual assets. Conducting home searches and seizing individuals’ cold wallets, since cold-storage assets are no longer considered to be untouchable. Yet, the impact of the above NTS incident reflects continuing flaws in handling of post-seizure assets and therefore the extent to which seized resources may be used maybe intended for the benefit of the public treasury, but are ultimately borne by the taxpayer (i.e., at the expense (loss) of the taxpayer).<h2>Expert Reactions and Community Backlash</h2>Crypto security experts &amp; blockchain analysts criticized the NTS for their ignorance of basic facts, including: <ol><li data-list="bullet">Never post mnemonic phrase(s) publicly.</li></ol> <ol><li data-list="bullet">A computer or devices should be physically stored offline before being examined. And, those devices should be in an encrypted air gapped container/box until the exam.</li></ol> <ol><li data-list="bullet">All photos from public sources must have the sensitive crypto data redacted.</li></ol> <ol><li data-list="bullet">Professor Cho Jae-woo expressed the irony that a government agency charged with recovering assets from crypto transactions has been the vehicle for one of the fastest drains of assets ever.</li></ol> In addition to affecting the public’s confidence and trust in NTS’ handling of crypto, there are increasing calls for mandatory training to meet the current standards set by industry best practices such as those developed by (Coinbase Custody) professional custodians or with regulatory protocols (Banks) in Singapore or the United States.<h2>Regulatory and Operational Lessons</h2>To stop recurrences, Agencies should implement: Key Management — Seeds or seed phrases should be stored offline and not photographed directly. Redaction Protocols — When releasing information about mnemonics or private keys, agencies should automatically blurr or pixelate the image to obscure the information. Dedicated Cryptographic Teams — Agencies should train personnel to handle wallets and their evidence in a way that is forensic (investigative) and custodial (safe). Monitoring Tools will enable agencies to receive alerts in real-time when a previously/safely held wallet is accessed after it was seized. South Korea can reference the U.S. Marshals Service (U.S.) and their ability to securely auction confiscated digital currency or European Union Frameworks (E.U.) for enforcement of data protection laws.<h2>Conclusion: A Costly Wake-Up Call</h2>The NTS leak of $4.8 million stolen in the PRTG hack isn't just a case of bad luck, it is another reminder that the blockchain has no mitigation for human mistakes. As cryptocurrency becomes more popular and governments are seizing large amounts due to new regulations and increased interest, they are doing so without the secure background to provide protection against future losses should criminals not cooperate. By South Korea implementing artificial intelligence tracking, mandatory disclosures, and penalties for evasion, this incident demands immediate change to processes in order to avoid seeing additional unrealized "seized" assets turn into national losses.

On Feb 26, 2026, National Tax Service exposed a seized wallet’s seed phrase in a press release, enabling a $4.8M PRTG crypto theft within hours.

South Korea Tax Leak Press Release Error Sparks $4.8M Crypto Theft

/media/contribution/car7bf79636780f4aafbede4423853baced/xe9_0308230107056.stxt

Bitcoin Options Markets Are Quietly Pricing in a $60,000 Retest — Here's What the Data Shows

/media/contribution/carc7da4e043dcb4e10a9e8d3243909c1b0/pal_0308233909778.stxt

Crypto Investment Products Snap Five-Week Outflow Streak with $1 Billion Inflows

/media/contribution/caracd62e8f0d5445ec857077aa3d518c8e/7jh_0306075906162.stxt

Trump's Tariff Rebound Impact on Crypto Markets: A Similar Pattern of Presidential Impact

/media/contribution/car98893cca7e9141a59f6bb946a8926b46/pyh_0306081641333.stxt

VanEck CEO Jan van Eck Says Bitcoin Is Near Its Bottom as the Four Year Cycle Winds Down

/media/contribution/carc087d2461d2246c88265373fd7e752f7/n73_0305085149638.stxt

OpenZeppelin Flags Methodological Flaws in OpenAI’s EVMbench Blockchain Security Benchmark

/media/contribution/card64dfa20791a4ce885f7eefffd9273be/f5y_0306080811327.stxt