Gwangju, South Korea – A significant sum of cryptocurrency, approximately 317 billion Korean won (roughly $237 million USD as of February 19, 2026), seized as evidence in a criminal case, has been fully recovered after being stolen through a phishing attack. The recovery, announced today by the Gwangju District Prosecutors Office, marks the successful conclusion of a complex investigation that highlighted vulnerabilities in the handling of digital assets by law enforcement.
The incident began last August when investigators accessing the cryptocurrency wallet during a transfer of custody inadvertently connected to a fraudulent website mimicking a legitimate platform. This allowed criminals to steal 320.88 Bitcoin, originally seized as proceeds from an online gambling operation. The loss wasn’t discovered until last month, when authorities attempted to transfer the funds to the national treasury following a Supreme Court ruling confirming the forfeiture of the assets.
The Gwangju District Prosecutors Office launched a swift investigation, identifying the digital wallet where the stolen Bitcoin was ultimately transferred. According to officials, they froze the wallet and worked with both domestic and international cryptocurrency exchanges, leveraging the G7 network, to prevent further transactions. Crucially, the investigation revealed that the perpetrator voluntarily returned the entire amount of Bitcoin to a wallet controlled by the prosecution on February 17th.
The recovery is a relief for the prosecution office, which faced scrutiny over its handling of the digital evidence. An internal review is underway to determine how the initial security breach occurred and to prevent similar incidents in the future. The office confirmed that, to date, no arrests have been made, and the investigation into the identity of the individual responsible for the phishing attack and the subsequent return of the funds is ongoing.
The initial lapse in security involved a failure to verify the contents of the digital wallet during routine monthly checks. Instead of confirming the Bitcoin balance, investigators only physically inspected the USB-like hardware wallet itself. This oversight allowed the theft to go undetected for months. The incident underscores the growing challenges law enforcement agencies face in securing and managing digital assets seized as evidence.
The successful recovery hinged on the rapid response of the prosecution office and its ability to track the stolen cryptocurrency across the global blockchain network. The office stated that it was able to block transactions through approximately 60 exchanges worldwide, effectively cornering the perpetrator and prompting the return of the funds. The case highlights the increasing importance of international cooperation in combating cryptocurrency-related crime.
While the stolen Bitcoin has been recovered and is currently held in an Upbit wallet, the investigation remains active. Prosecutors are continuing to investigate the circumstances surrounding the theft, including whether any internal assistance was provided to the perpetrator. They have also initiated a separate investigation into the operators of the phishing website and the companies involved in its domain registration, according to a statement released by the office.
The incident serves as a cautionary tale for law enforcement agencies worldwide, emphasizing the demand for robust security protocols and ongoing training in the handling of digital evidence. As cryptocurrency becomes increasingly prevalent in criminal activity, the ability to secure and manage these assets will be crucial for effective law enforcement.
The Gwangju District Prosecutors Office plans to release a more detailed report on the incident and the recovery process in the coming days. Authorities are urging anyone with information related to the case to reach forward.
Disclaimer: Cryptocurrency investments are subject to significant risk. This article provides information about a specific law enforcement case and should not be considered financial advice.
Readers with questions or concerns about cryptocurrency security are encouraged to consult with qualified cybersecurity professionals.
