Hackers Restore $21 Million BTC to South Korean Authorities

• The prosecution confirmed they did not arrest the suspects or seize the private keys.
• Authorities believe the funds were returned because they had blocked all exit routes.
• The returned Bitcoin was moved to a secure wallet at Upbit to prevent another theft.

South Korean authorities have gotten back about $21 million in Bitcoin after the hacker who stole it from government wallets returned the funds. This is a rather surprising turn of events in what’s been a series of crypto custody mishaps involving South Korean law enforcement.

The prosecution confirmed they did not arrest the suspects or seize the private keys. Instead, the stolen funds were quietly returned to the wallet that the prosecution still controlled.

Related: Audit Fails as 22 Seized Bitcoins Vanish from Seoul Police Custody

Authorities believe the thieves returned the funds because law enforcement had successfully blocked all exit routes. They had requested domestic and international exchanges to freeze any transfers from the linked addresses, making it nearly impossible for the hackers to convert the Bitcoin into cash.

As soon as the South Korean authorities saw the funds return to their wallet, they moved the Bitcoin to a secure wallet at Upbit (a well-known Korean exchange) in an effort to prevent another theft.

The law officials are working to catch the person responsible, and the investigation is ongoing. One official said: “We’re committed to arresting the perpetrator, even though the Bitcoin is back, and we’ll keep investigating to get the full picture of what happened.”

It’s still unclear exactly who the hacker is or why they gave the funds back, but this kind of thing is not unprecedented. Because blockchains are transparent, investigators can often track stolen funds as they move between wallets. Sometimes hackers return crypto to lower their legal risk, try for a lighter sentence, or because the money becomes too hard to move once it’s flagged.

History of Inadequate Security

This case is part of a larger pattern of crypto security problems in South Korea, where seized assets have repeatedly gone missing due to poor handling. 

In this particular case, the Gangnam Police Station lost the $21 million worth of Bitcoin when staff were tricked by a phishing attack and gave away wallet login info.

In another case, Gwangju prosecutors lost 22 Bitcoin worth around $1.5 million after the funds vanished from a USB-style cold wallet, even though the device itself was still in police custody. The loss wasn’t noticed for years until a recent national audit of seized crypto was carried out.

Related: South Korea Busts Crypto Laundering Ring Behind 150 Billion Won FX Scheme