South Korean prosecutors have recovered approximately $21 million worth of Bitcoin that was previously stolen from government custody, according to local reports. The funds were returned after months of tracking, marking a rare case in which stolen cryptocurrency was voluntarily transferred back to authorities.
The incident involved 320.88 BTC, originally seized by prosecutors in a raid on an illegal gambling website. At the time of the theft in August 2025, the Bitcoin was valued at roughly $21 million.
Phishing Breach Led to Loss of Seized Bitcoin
Authorities disclosed that the loss occurred after a recovery seed phrase tied to the confiscated Bitcoin wallet was entered into a phishing website. The error allowed an unidentified attacker to gain control of the wallet and transfer the assets out of government custody. Authorities did not initially detect the loss until late 2025, but they immediately triggered an internal review and tracking operation once it came to light.
Over the next months, investigators monitored the stolen Bitcoin on-chain and worked with domestic and international exchanges to freeze or block attempts to cash out the assets. On February 17, 2026, the attacker transferred the full amount back to an address already under prosecutorial control. Authorities have since moved the Bitcoin to a secure domestic exchange wallet, but the probe continues.
The recovery did not result from an arrest or direct seizure, as the identity of the person or group who returned the funds remains unknown. However, officials have said they will continue efforts to identify and prosecute those responsible for the original theft.
Deeper Confiscated Asset Management Issues Uncovered
The case has raised questions about digital asset custody practices among South Korean law enforcement. Reports indicate that the Seoul Gangnam Police Station also struggled to account for cryptocurrency held in cold storage, with 22 BTC reportedly missing since 2021, prompting additional internal probes.
In response, the Gyeonggi Bukbu Provincial Police Agency has launched its own internal probe. Officials aim to determine whether the loss resulted from procedural errors or possible internal involvement.
Authorities believe that cooperation with centralized exchanges and overseas trading platforms, and requests to freeze withdrawals, which limited the hacker’s ability to liquidate the stolen Bitcoin, may have pressured the return. The incident underscores the challenges of securing seized digital assets and the importance of robust custody procedures as cryptocurrencies become increasingly prominent in legal and financial contexts.
Broader Bitcoin and Crypto Context
The recovery of the stolen Bitcoin comes as South Korea’s Financial Services Commission is implementing updated crypto regulations to expand legal trading for 3,500 companies, part of broader efforts to strengthen the country’s position in digital finance. By reopening the market to corporate participants after nearly nine years, regulators appear to be aiming for deeper liquidity, improved price stability, and stronger integration with global crypto markets.
These policy changes fall right in the middle of renewed volatility in Bitcoin and the broader cryptocurrency market, but heightened institutional participation. Institutional participation has increasingly shaped market dynamics in recent cycles, and South Korea’s decision to reintroduce corporate access may influence regional liquidity flows at this time when global digital asset markets are closely watching regulatory developments.
Temitope Olajide
Evans Kelvin
