Because the press release was widely circulated online, the thief could be anyone. South Korea’s National Tax Service has no clear suspects, Gizmodo suggested, and no easy way to claw back funds.
The officials’ best bet might be if the thief tries to move the stolen tokens through a regulated exchange, but The Block noted that the thief might struggle to convert that much cryptocurrency into cash under current market conditions. So seemingly, the thief, who likely wasn’t expecting the big payday anyway, may be motivated to lie low and avoid major exchanges.
Cho suggested that cops could have easily prevented the theft, likening posting any image of the mnemonic recovery phrase to leaving a wallet wide open. He noted that the original holder of the Ledger wallet was following best practices by only recording the phrase on a handwritten note and not storing the password online. Cops should have known to check the images for the recovery phrase, Cho said, and their mistake will likely cost the national treasury billions of won.
It’s possible that whoever took the cryptocurrency just seized on an opportunity after seeing the cops’ failure to redact the images while scrolling through the National Tax Service’s press releases at dawn. It’s also possible that bad actors are closely monitoring South Korean police cryptocurrency announcements, following what The Block reported was “a series of crypto custody lapses.”
In January, officials in Gwangju had to investigate after “a substantial quantity of seized bitcoin was lost,” The Block reported. That was believed to be linked to a phishing attack targeting Coinbase but perhaps signaled that police weren’t always adequately securing seized assets.
Even more disturbingly, last month, police in Seoul’s Gangnam district had to launch an internal investigation after 22 seized bitcoins went missing, The Block reported. That case also involved a cold wallet suddenly drained without the physical device leaving police control, possibly indicating that some sensitive information isn’t handled securely.
In the latest press release, the National Tax Service officer said they are strengthening internal controls and job training to prevent future leaks.