How can similar incidents be prevented in the future?

Implementing strict operational security protocols, including thorough review processes for public disclosures and secure handling of sensitive information, can prevent such exposures.

South Korea Tax Agency's Data Exposure Results in $4.8M Crypto Theft

A critical security lapse by South Korea's National Tax Service led to the unauthorized transfer of $4.8 million in digital assets, highlighting the importance of secure digital asset management.

Published: February 28, 2026

Share this on:

Executive Summary

In February 2026, South Korea's National Tax Service (NTS) inadvertently exposed the mnemonic recovery phrase of a seized cryptocurrency wallet in an official press release. This oversight allowed unauthorized individuals to access and transfer approximately 4 million Pre-Retogeum (PRTG) tokens, valued at $4.8 million, from the wallet. The incident underscores significant lapses in the secure handling of digital assets by governmental bodies.

This event highlights the critical need for stringent operational security measures when managing and disclosing information related to digital assets. The exposure of sensitive data, such as wallet recovery phrases, can lead to substantial financial losses and erode public trust in institutional competence.

Why This Matters Now

The incident underscores the urgent need for governmental agencies to implement robust security protocols when handling digital assets. As cryptocurrency adoption grows, ensuring the secure management of these assets is paramount to prevent similar breaches and maintain public trust.

Attack Path Analysis

The South Korean National Tax Service (NTS) inadvertently exposed the mnemonic recovery phrase of a seized cryptocurrency wallet in a public press release. This exposure allowed an unauthorized actor to gain full access to the wallet, leading to the unauthorized transfer of 4 million Pre-Retogeum (PRTG) tokens, valued at approximately $4.8 million, to an external address. The attacker first deposited a small amount of Ethereum (ETH) to cover transaction fees before executing the transfer. The incident underscores the critical importance of safeguarding sensitive information to prevent unauthorized access and asset theft.

Kill Chain Progression

Initial Compromise

High

Privilege Escalation

High

Lateral Movement

Lowinferred

Command & Control

Mediuminferred

Exfiltration

High

Impact

High

Initial Compromise

Description

The NTS inadvertently published the mnemonic recovery phrase of a seized cryptocurrency wallet in a public press release, exposing sensitive information.

Confidence:

High

MITRE ATT&CK® Techniques

Techniques identified for SEO/filtering; may be expanded with full STIX/TAXII enrichment later.

Impact

T1657

Financial Theft

Initial Access

T1078

Valid Accounts

Discovery

T1087

Account Discovery

Credential Access

T1552.001

Unsecured Credentials: Credentials in Files

Exfiltration

T1567.002

Exfiltration Over Web Service: Exfiltration to Cloud Storage

Potential Compliance Exposure

Mapping incident impact across multiple compliance frameworks.

PCI DSS 4.0 – Protect stored cardholder data

Control ID: 3.4

The exposure of sensitive data, such as wallet seed phrases, indicates inadequate protection of stored sensitive information, violating PCI DSS requirements for data security.

NYDFS 23 NYCRR 500 – Cybersecurity Policy

Control ID: 500.03

The incident suggests deficiencies in the organization's cybersecurity policies and procedures, as required by NYDFS regulations, leading to unauthorized access to sensitive data.

DORA – ICT Risk Management Framework

Control ID: Article 5

The breach highlights weaknesses in the organization's ICT risk management framework, as mandated by DORA, compromising the operational resilience of financial services.

CISA ZTMM 2.0 – Identity Management and Access Control

Control ID: Identity

The unauthorized access to sensitive information indicates lapses in identity management and access control measures, contravening Zero Trust principles outlined by CISA.

NIS2 Directive – Security of Network and Information Systems

Control ID: Article 21

The incident demonstrates insufficient security measures for network and information systems, violating NIS2 Directive requirements for ensuring system integrity and confidentiality.

Sector Implications

Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.

Government Administration

Data exposure incidents highlight critical gaps in digital asset handling procedures, requiring enhanced data protection protocols and staff training on cryptocurrency security management.

Financial Services

Cryptocurrency wallet seed exposure demonstrates urgent need for encrypted traffic monitoring, egress security controls, and zero trust segmentation for digital asset protection.

Law Enforcement

Evidence handling procedures must incorporate advanced cybersecurity controls including threat detection, secure connectivity, and proper digital asset custody protocols to prevent data breaches.

Computer/Network Security

Incident validates demand for multicloud visibility solutions, anomaly detection systems, and comprehensive security frameworks addressing cryptocurrency and blockchain technology vulnerabilities.

Sources

$4.8M in crypto stolen after Korean tax agency exposes wallet seedhttps://www.bleepingcomputer.com/news/security/48m-in-crypto-stolen-after-korean-tax-agency-exposes-wallet-seed/
Verified

Police investigate alleged theft of $4.8 million in cryptocurrency seized by National Tax Servicehttps://koreajoongangdaily.joins.com/news/2026-02-28/national/socialAffairs/Police-investigate-alleged-theft-of-48-million-in-cryptocurrency-seized-by-National-Tax-Service/2533966

Verified

South Korea's Tax Agency Seed Leak: A $4.8M Liquidity Eventhttps://www.ainvest.com/news/south-korea-tax-agency-seed-leak-4-8m-liquidity-event-2602/

Verified

Frequently Asked Questions

The National Tax Service inadvertently published a press release containing images that exposed the mnemonic recovery phrase of a seized cryptocurrency wallet, allowing unauthorized access and transfer of the assets.

Cloud Native Security Fabric Mitigations and ControlsCNSF

Aviatrix Zero Trust CNSF is relevant to this incident as it could have limited the attacker's ability to exploit the exposed mnemonic phrase by enforcing strict segmentation and identity-aware access controls, thereby reducing the potential blast radius of the breach.

Initial Compromise

Control: Cloud Native Security Fabric (CNSF)

Mitigation: The exposure of sensitive information could have been constrained by implementing strict access controls and segmentation, thereby reducing the likelihood of unauthorized access.

Privilege Escalation

Control: Zero Trust Segmentation

Mitigation: The attacker's ability to escalate privileges could have been limited by enforcing strict identity-based access controls, reducing unauthorized access.

Lateral Movement

Control: East-West Traffic Security

Mitigation: Potential lateral movement within internal systems could have been constrained by monitoring and controlling east-west traffic, reducing unauthorized access.

Command & Control

Control: Multicloud Visibility & Control

Mitigation: The attacker's ability to establish control over the wallet could have been constrained by providing real-time visibility and control over cloud resources, reducing unauthorized actions.

Exfiltration

Control: Egress Security & Policy Enforcement

Mitigation: The unauthorized transfer of assets could have been constrained by enforcing strict egress policies, reducing unauthorized data exfiltration.

Impact (Mitigations)

The financial impact of the unauthorized transfer could have been reduced by implementing comprehensive security measures, limiting the extent of asset loss.

Impact at a Glance

Affected Business Functions

Asset Management
Public Relations
Legal Compliance

Operational Disruption

Estimated downtime: N/A

Financial Impact

Estimated loss: $4,800,000

Data Exposure

Exposure of confidential recovery phrases for seized cryptocurrency wallets.

Recommended Actions

• Implement strict data handling protocols to prevent accidental exposure of sensitive information.
• Utilize Zero Trust Segmentation to enforce least privilege access and minimize potential attack surfaces.
• Enhance visibility and control over multicloud environments to detect and respond to unauthorized activities promptly.
• Apply Egress Security & Policy Enforcement to monitor and control outbound data transfers, preventing unauthorized exfiltration.
• Conduct regular security training for personnel to raise awareness about the importance of protecting sensitive information.

Secure the Paths Between Cloud Workloads

A cloud-native security fabric that enforces Zero Trust across workload communication—reducing attack paths, compliance risk, and operational complexity.

Stop Advanced Threats Get a Free Workload Attack Path Assessment Under Active Attack?

South Korea Tax Agency's Data Exposure Results in $4.8M Crypto Theft

Executive Summary

Why This Matters Now

Attack Path Analysis

Kill Chain Progression

Initial Compromise

Description

MITRE ATT&CK® Techniques

Financial Theft

Valid Accounts

Account Discovery

Unsecured Credentials: Credentials in Files

Exfiltration Over Web Service: Exfiltration to Cloud Storage

Potential Compliance Exposure

PCI DSS 4.0 – Protect stored cardholder data

NYDFS 23 NYCRR 500 – Cybersecurity Policy

DORA – ICT Risk Management Framework

CISA ZTMM 2.0 – Identity Management and Access Control

NIS2 Directive – Security of Network and Information Systems

Sector Implications

Government Administration

Financial Services

Law Enforcement

Computer/Network Security

Sources

Frequently Asked Questions

Cloud Native Security Fabric Mitigations and ControlsCNSF

Impact at a Glance

Affected Business Functions

Recommended Actions

Key Takeaways & Next Steps

Secure the Paths Between Cloud Workloads