Breaches and incidentsBriefConfirmed by two or more outlets
South Korea National Tax Service: seized wallet’s seed phrase published in a press photo
26 Feb 2026: an NTS press release about raids on 124 tax evaders included an unredacted photo of a seized Ledger device and its handwritten recovery phrase.
- Disclosed
What happened
- 26 Feb 2026: an NTS press release about raids on 124 tax evaders included an unredacted photo of a seized Ledger device and its handwritten recovery phrase. About 4M PRTG tokens (about USD 4.4M to 4.8M) were then moved to an attacker wallet.
- Root cause: the seed phrase was published in an official press photo.
- Attribution: none.
- Response: the release was removed. The NTS apologized. The Deputy Prime Minister ordered a cross-agency review of how seized digital assets are handled. Whether funds were returned is disputed between outlets.
Sources
- https://bleepingcomputer.com/news/security/48m-in-crypto-stolen-after-korean-tax-agency-exposes-wallet-seed
- https://decrypt.co/359404/ethereum-tokens-swiped-returned-south-korean-tax-service
- https://heise.de/-11195050
This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.