South Korea’s Tax Agency Turns to Private Custody After $4.8M Crypto Security Blunder

South Korea’s National Tax Service (NTS) is searching for a private custodian to manage seized cryptocurrency — a direct consequence of an embarrassing security failure that exposed a wallet recovery phrase in an official government press release and led to the unauthorised transfer of nearly $5 million in confiscated digital assets.

The incident has forced one of Asia’s most digitally advanced economies to confront an uncomfortable reality: government agencies are not equipped to safely hold crypto, and the cost of learning that lesson on the job is now running into the millions.

A Seed Phrase in Plain Sight

On February 26, the NTS published a press release that inadvertently included a photograph of a Ledger cold wallet alongside a sheet of paper displaying the device’s mnemonic seed phrase — unredacted and fully visible. For anyone unfamiliar with how crypto wallets work, a seed phrase is the master key to everything stored inside. Whoever holds it, owns the funds.

The result was swift and predictable. Unauthorised actors used the exposed phrase to access the wallet and drain approximately $4.8 million worth of confiscated tokens. The assets were gone before the agency could respond.

The leak was not a sophisticated hack. There was no zero-day exploit, no social engineering campaign, no breach of encrypted systems. Someone simply forgot to blur a piece of paper in a photo — and millions of dollars walked out the door.

The Plan: Outsource to the Professionals

According to reporting by ZDNet Korea, citing people familiar with the matter, the NTS is now drafting a framework to hand seized crypto custody over to a qualified private provider. The agency is aiming to finalise its selection within the first half of 2026.

Candidate firms will reportedly be evaluated on several criteria: security standards and infrastructure, company size and operational track record, and — critically — whether they hold insurance under South Korea’s Virtual Asset User Protection Act. That last requirement reflects a broader push in South Korea to ensure that firms handling digital assets carry meaningful financial accountability, not just technical credentials.

The selection process will be overseen by a newly formed internal task force specifically created to modernise how the NTS manages digital asset seizures from end to end.

Building the Infrastructure From Scratch

The task force’s mandate extends well beyond simply picking a custody vendor. According to ZDNet Korea, the group is working on a comprehensive overhaul of the agency’s approach to seized crypto — covering the entire asset lifecycle from initial seizure through secure storage to eventual liquidation.

That includes rewriting operational manuals, running staff training programmes and conducting formal assessments of existing practices. The goal is to replace the current patchwork of departmental responsibilities with a coherent, centralised system.

An NTS official acknowledged to ZDNet Korea that because crypto is a relatively new asset class, responsibilities have historically been fragmented across multiple departments with no single unit owning the problem. A dedicated division focused exclusively on crypto-related work is now being established to close that gap.

One Leak Was Not the Only Problem

The seed phrase incident alone would have been enough to prompt a policy review. But the NTS leak was not an isolated case — it arrived alongside a separate and equally damaging failure.

Seoul’s Gangnam police district allegedly lost 22 Bitcoin that had been seized as part of an enforcement action, raising questions about whether the custody problem was systemic rather than limited to one agency.

The combination of both incidents triggered a government-wide response. On March 1, South Korea’s Deputy Prime Minister and Minister of Economy and Finance, Koo Yun-cheol, announced a cross-agency investigation into how the government handles seized digital assets. The probe spans multiple departments and is intended to identify gaps before more assets are lost.

A Wider Warning for Governments Holding Crypto

South Korea’s predicament is not unique. As enforcement actions against crypto fraud and tax evasion increase globally, governments are accumulating significant digital asset holdings with little of the infrastructure or expertise needed to protect them.

Traditional custody frameworks — built around physical assets, bank accounts and paper records — do not translate cleanly to cryptocurrency. Seed phrases, hardware wallets, private key management and blockchain-based transfers require a specialist skill set that most public agencies simply do not have in-house.

The NTS’s decision to move toward professional private custody is the pragmatic response. But the damage has already been done: $4.8 million gone, a separate police custody failure, and an inter-agency investigation that puts South Korea’s digital asset governance under uncomfortable scrutiny — all because of a piece of paper that should have been blurred.