Yeliz Akmaca 
A quiet internal audit, an unexpected transfer and all that remained was a USB drive. In Seoul’s Gangnam district, authorities discovered that 22 Bitcoin held in custody since 2021 had vanished. Roughly $1.5 million worth of assets were found to have been digitally moved to other addresses, even though the physical cold wallet itself was still in police possession.
What makes the situation stranger is that while the USB device remained with police, the digital assets inside had already been transferred elsewhere.
What happened and how was it discovered?
The Bitcoin were voluntarily surrendered by suspects during an investigation in November 2021. Because the case was later suspended, the assets were not actively monitored for a long period. That changed only after a separate loss in Gwangju triggered nationwide routine inspections.
During the internal review, investigators found the following: the USB-style cold wallet was still held by police but the BTC inside was gone.
This detail matters. Since the hardware was not stolen, it suggests the private keys may have been accessed by a third party. Early findings indicate that the wallet password was leaked, enabling unauthorized transfers.
The Gyeonggi Northern Provincial Police Agency has launched a formal internal investigation to clarify the circumstances and rule out any internal involvement. Access logs, key management procedures, and on-chain activity are all under review. For now, no staff members have been publicly accused.
Not a technical exploit human error
Sources close to the case say the Bitcoin were stored on a portable USB device rather than a more robust institutional custody system. There are also indications that the wallet password was exposed during a routine inspection.
This mirrors a pattern seen repeatedly in recent crypto losses: assets are often compromised not through sophisticated hacks, but through social engineering and weak internal controls. Phishing attacks aren’t technical they’re deceptive. One trusting click, and the consequences can be massive.
A brief side note: claims that 320 BTC seized in Gwangju were lost after investigators accidentally accessed a phishing site helped trigger the broader inspection wave.
Authorities are now reviewing blockchain transaction records to determine whether the missing BTC were sent to external wallets. So far, no recovery has been announced publicly, and details remain limited while the investigation continues.
Seizure of digital assets is becoming institutionalized in South Korea
This incident sits within a larger framework. In South Korea, the seizure of digital assets has gradually become formalized following landmark Supreme Court rulings confirming that cryptocurrencies can be treated as property under the Criminal Procedure Act.
In March 2024, the Gwangju District Prosecutors’ Office also attempted to recover Bitcoin worth approximately 170 billion won in connection with another illegal gambling operation. State capacity is clearly expanding yet this case highlights persistent gaps in custody and internal control.
You can also freely share your thoughts and comments about the topic in the comment section. Additionally, don’t forget to follow us on our Telegram, YouTube, and Twitter channels for the latest news and updates.