Hacker Returns $21M in Stolen Bitcoin

Key Highlights:

• South Korean prosecutors recovered about $21.4 million in Bitcoin after the stolen funds were quietly returned by the hacker.
• The breach happened when investigators entered a recovery seed phrase on a phishing site, allowing the attacker to drain seized crypto holdings.
• Authorities had frozen the hacker’s wallets on exchanges, limiting cash-out options and likely prompting the return, while investigations into the perpetrator continue.

South Korean prosecutors have recovered a large portion of Bitcoin that was stolen from government custody last year. This episode marked closing a high-profile case that exposed serious loopholes in the country’s handling of seized cryptos.

According to local media reports, authorities have regained about $21.4 million worth of Bitcoin after the funds were unexpectedly returned by the unknown perpetrator.

South Korea Recovers Bitcoin Stolen from Govt Custody

The case dates back to August last year, when investigators mistakenly compromised their own holdings. During a routine interrogation, officials accessed a phishing website and entered a recovery seed phrase tied to Bitcoin seized in an earlier raid on an illegal gambling platform. This mistake helped the attacker to drain the wallet.

The loss was discovered in December,which then triggered an internal review. Authorities then moved to contain the damage by identifying and monitoring the stolen funds on-chain and coordinating with exchanges to block any attempt to liquidate them.

On Tuesday, the situation took an unexpected turn. A total of 320.8 BTC was transferred back to a wallet controlled by law enforcement. Prosecutors confirmed the transfer and said the assets were immediately moved to a secure domestic exchange wallet for safekeeping while the investigation continues.

Officials acknowledged that the recovery did not result from an arrest or a direct seizure. Instead, the Bitcoin was quietly returned to an address already under prosecutorial control. The identity of the hacker remains unknown.

Investigators believe their freeze requests to centralized exchanges and cooperation with overseas trading platforms restricted the attacker’s ability to convert the stolen funds into cash. Those measures appear to have created enough pressure to prompt the return.

Authorities also went for follow-up actions targeting phishing infrastructure linked to the breach. This included examining domain registrars and operators of fraudulent websites believed to have facilitated the theft.

The case has ignited issues about how South Korean agencies store and manage confiscated crypto assets. A separate review revealed that the Seoul Gangnam Police Station has been unable to account for 22 BTC held in a cold wallet since 2021.

In response, the Gyeonggi Bukbu Provincial Police Agency has launched its own internal probe. Officials aim to determine whether the loss resulted from procedural errors or possible internal involvement.

The prosecutor’s office has said it will continue efforts to identify and apprehend those responsible for the theft, even though the majority of the assets have been recovered. Authorities also plan to strengthen custody procedures for digital evidence going forward.

The incident comes at a time of policy change in South Korea’s crypto sector. Recently, the Financial Services Commission introduced updated laws that will now allow nearly 3,500 companies to legally trade cryptos. This decision is made towards building a competitive digital finance hub within the country.

Notably, South Korea’s regulatory views toward crypto has shifted immensely over the past decade. In 2017, during a period of active retail speculation, regulators banned corporate participation in the crypto market. Officials cited concerns over market manipulation, money laundering, and systemic risk.

That policy left retail investors dominating almost the entire domestic trading volume. Institutions and corporations were sidelined. Over time, capital began flowing out of the country into foreign exchanges. Estimates suggest that outflows reached tens of trillions of won in recent years.

The retail-heavy structure also contributed to price distortions, including the well-known “Kimchi Premium,” where domestic Bitcoin prices traded above global averages.

After nearly nine years, authorities are now reopening the market to corporate participants.

Also Read: Uxlink Hacker Returns, Snaps Up $10.87M in Ethereum After Months of Silence