South Korean Prosecutors Recover $21.4M Stolen Bitcoin as Hacker Returns 320 BTC

A hacker who sent 320.88 Bitcoins (approximately US$21.4 million) to a government-controlled wallet cooperatively returned all of the money to South Korean law enforcement. After an extensive investigation into one of South Korea's worst cases of cryptocurrency security mishaps by its police force, the recovery of the cryptocurrency was confirmed by the Gwangju District Prosecutor's Office on February 17, 2021. The Bitcoins were being held by law enforcement as evidence from a raid of an illegal gambling operation. The detectives who were to return the evidence in a normal evidence transfer in August 2020 mistakenly entered the wallet recovery seed phrases into a phishing website, thus giving the hacker complete control of the wallet. It was not until a routine audit in December 2020, approximately 4 months after the theft occurred, that the prosecutors became aware that the Bitcoin was missing.

No arrests or seizures were made during the recovery of 320.8 BTC (the amount has been changed from what is reflected in the above blog post). All bitcoins were moved back to the hacker's current prosecution-controlled account without detection. The bitcoins were then transferred into a secured wallet at a local exchange and secured inside the wallet to prevent any transfers. At this time, the identity of the hacker still has not been determined and when bitcoin is obtained, that prosecution still has to pursue that suspect, and GPBPA will do their own investigation of that transfer and the possibility of insiders being involved.

How the Theft Happened: A Phishing Attack on Law Enforcement

The mechanics of the breach are simple and damning. During the evidence transfer for the gaming platform investigation, the investigator saw what they thought was an authentic website, but it turned out to be an identical phishing site that was created to obtain credentials from victims. The investigator entered a recovery seed phrase, which is the master key to any cryptocurrency wallet. Therefore, the attacker had everything they needed to remotely access the funds; just by having that 12- or 24-word phrase. There were no complex exploits. No zero-day vulnerabilities, only a duplicitious website, and a government employee who did not Check the URL.

The timing of the theft is another factor in the greater delays in locating the stolen property. The theft took place in August 2025. The prosecutors did not seize the stolen bitcoin until December, four months later. This suggests there was no ongoing or real-time tracking of the confiscated crypto assets. There were no auto-generated alerts when an account's balance fell below a certain threshold, nor was there a multi-signature approved process that would require all parties involved in a transfer to approve said transfer before it could be executed. Management of this wallet appears to have been done with little regard for it, similar to how you would manage a savings account that has been forgotten about. Thus, the result has been a failure of the system, and not just a one-off mistake for an office with millions of dollars' worth of digital evidence.

Why the Hacker Returned the Bitcoin

The most interesting thing about this story is how the hacker returned stolen crypto assets by way of voluntarily returning the crypto. There are very few examples of stolen Crypto being returned to its rightful owner, with the most common examples being sold off in unregulated transactions, moved to another blockchain via bridging, and/or laundered through mixing! The hacker's return of every single satoshi demonstrates how well the authorities had shut down all exit points from crypto. Within a short time after the hack occurred, the prosecutors immediately started to work with domestic exchanges to freeze any accounts and transactions related to the stolen bitcoin. All transactions were able to be tracked due to the hack occurring on a public blockchain. As a result of not being able to bridge/sell/swap bitcoin for any other asset without creating an exchange-level block, the hacker was left with no option but to return the stolen bitcoin.

In this case, the blockchain was able to provide the expected level of transparency. Once the authorities were aware of what to look for, they were able to follow the stolen assets in real-time using Bitcoin's permanent public ledger. The remainder of the process relied on cooperation from the exchanges. The only options available to the thief were to repay the BTC to the wallets of the victims, or hold the BTC indefinitely as the centralized exchanges complied with the freeze requests. The decision was made to return the stolen funds. Rather than being a testament to law enforcement genius, the fact that stolen crypto currency can be rendered almost worthless through the combination of the blockchain's built-in transparency and the centralized exchanges' compliance is what is being highlighted.

A Bigger Problem: South Korea's Seized Crypto Management Crisis

The instance that occurred in Gwangju is not an isolated event; another failure can also be found at the Gangnam Police Station in Seoul, where a report indicates that 22 BTC (approximately $1.5 million at current values) has been unaccounted for in a cold wallet since 2021. This incident reflects an entirely different failure of another organization with a different loss and group of people involved. One of the world's largest exchanges, Bithumb, also has a similar issue when it mistakenly distributed over $40 billion in Bitcoin due to an error on their website but was able to retrieve 99.7% of the funds. When viewed together, all of these events represent an ecosystem where basic custody discipline continues to be an issue for both public and private custody organizations.

Legal authorities in South Korea have been outspoken when discussing this topic. Industry insiders explained to The Korean Economic Daily that old ways of storing crypto evidence (i.e., locking it up in a safe like physical cash) will not work when dealing with digital assets. Until there is a system in place with multi-signature custody, an ability to monitor balances in real-time, and restrictions on who has access; this will be an ongoing issue. The organization that was the source of the recovered funds has since transferred the money into an exchange wallet, which has freeze protection; however, this is still only a reactive solution rather than a structural one. The larger question is whether investigative agencies in South Korea will adopt an institutional level of custody protection before the next occurrence of data theft.

The Regulatory Tailwind: Why This Matters for South Korea's Crypto Future

The timing of this incident is delicate. South Korea is in the middle of a major regulatory change. In January, after the Financial Services Commission established standards, the nine-year prohibition on corporate crypto-trading has been lifted. As a result, each of the 20 largest cryptos by market capitalization, roughly 3,500 listed businesses and professional investment companies, can receive up to five percent of equity capital.

Also included in the government's 2026 Economic Growth Strategy is a Digital Asset Basic Act, stablecoin legislation, and the potential regulation of spot Bitcoin ETFs. South Korea is positioning itself as a center for competitive digital finance.

Of course, trust is the basis for all these activities, such as having faith that there are sufficient regulatory mechanisms to protect investors, that there are sufficient institutional safeguards for securing digital assets, and that law enforcement can securely handle any cryptocurrencies seized from wrongdoers without falling prey to phishing or other attacks that may remove large sums of money. The success of the Gwangju recovery will be in the full restoration of all assets seized from the exchange, continuity in the basic market functioning of the cryptocurrency market, and an example of how cooperation among exchanges could put additional pressure on other exchanges that cyber criminally invade their systems to return the assets they reportedly stole. However, the main point of this story for cryptocurrency investors to understand is the failure of the foundation of this scheme. An employee of a government entity, by entering a seed word into a phishing site, lost $21 million in Bitcoin; the hacker returned the funds; however, they may not do so again the next time.