Police have arrested a suspect in his 40s in connection with two separate cryptocurrency theft incidents involving the National Tax Service (NTS). Authorities are pursuing additional suspects related to the second breach.
According to the National Police Agency on Monday, the Cyber Terror Investigation Unit apprehended the suspect on January 1 following a referral from the NTS last month regarding the cryptocurrency theft.
Police received a confession letter from a hacker who stole and returned NTS cryptocurrency, stating he "took it but returned it and is reflecting on his actions." However, investigators discovered that the returned cryptocurrency was subsequently transferred to another account, prompting the search for additional suspects.
The confessor reportedly claimed he attempted the theft out of curiosity after seeing an internet post revealing that the NTS had exposed its mnemonic code, and returned the assets the following day.
"We arrested the initial perpetrator in his 40s on the 1st and are tracking the second thief," a police official said.
The NTS inadvertently exposed a "mnemonic code"—a master key for cryptocurrency wallets—on December 26 when it distributed a press release announcing the seizure of four cold wallet USBs containing delinquent taxpayers' cryptocurrency. Allegations emerged shortly after that digital assets in the exposed wallets had been stolen. The stolen cryptocurrency (PRTG coin) was reportedly worth approximately 4 million tokens valued at $4.8 million (about 6.9 billion won). However, analysts noted the actual damage may be limited as the tokens have no trading activity and are virtually impossible to convert to cash.
Meanwhile, the National Police Agency announced plans to strengthen its cryptocurrency evidence management system following an incident at Seoul's Gangnam Police Station. The station lost 22 bitcoins (worth approximately 2 billion won) in 2022 after failing to follow custody protocols for virtual assets established in 2021.
Under the new guidelines, two designated custodians will be responsible for wallet management, and hardware wallets along with recovery phrases will be sealed for storage.
"We have implemented detailed regulations dividing the seizure process into four stages: preparation, seizure, storage, and transfer," a police official said. "We are preparing to implement a system in the first half of the year that will entrust seized cryptocurrency to private operators for safekeeping."
Police said they will develop comprehensive cryptocurrency seizure protocols to strengthen future management systems.