Change Of Heart? Hacker Returns $21M Stolen Bitcoin To South Korean Prosecutors

A hacker has returned 320 Bitcoin (BTC) stolen from South Korean prosecutors throughout a phishing scam last year. As authorities face backlash over repeated incidents, officers have pledged to continue the investigation to uncover the full details and strengthen their custody practices.

Stolen Bitcoin Returned To Gwangju Prosecutors

On Thursday, the Gwangju District Prosecutors’ Office announced it recovered 320.8 Bitcoin lost in August to a phishing attack after the malicious actors willingly sent back the assets earlier this week.

Local news outlet Digital Asset reported on Tuesday that the on-chain data showed the lost BTC, worth $21 million, had been transferred to a wallet managed by South Korean authorities. The assets were seemingly moved through multiple addresses before being transferred to a domestic crypto exchange wallet.

As reported by Bitcoinist, South Korean prosecutors faced backlash last month after discovering that a large stash of seized BTC had gone missing months ago. Authorities reportedly learnt of the loss during a routine check of seized financial assets held as criminal evidence.

After an internal review, prosecutors found that the crypto assets were lost to a scam in August during the handling of the sized assets. Reportedly, malicious actors drained the wallets after investigators mistakenly accessed a phishing website.

Notably, the lost Bitcoin was originally seized during a 2021 investigation into an illegal gambling website. Prosecutors launched an investigation after discovering the incident. They also took measures to recover the assets, including blocking transactions from the perpetrator’s address to domestic exchanges and sending cooperation requests to overseas exchanges.

According to the report, authorities believe that these measures exerted pressure on the hackers, ultimately pushing them to return the funds. Meanwhile, prosecutors are currently continuing to track down the malicious actors while also conducting related investigations and inspections.

“(Regardless of the recovery of the Bitcoin), we will do our utmost to apprehend the perpetrators in the future,” The Gwangju District Prosecutors’ Office stated. “We plan to continue conducting a rigorous investigation to clearly uncover the full details of the case.”

Authorities Slammed Over Repeated Incidents

The Gwangju incident has led to a nationwide review of law enforcement’s handling of virtual assets. The review has revealed another security breach at the Seoul Gangnam Police Station.

Last Friday, the Gangnam station announced it had lost 22 BTC that were voluntarily submitted to authorities during an investigation in November 2021. According to local reports, the leak had not been detected until now, since the investigation into that case had been suspended.

The inspection revealed that the cold wallet storing the Bitcoin was not stolen, but the assets stored inside “had vanished without a trace.” As a response, the Gyeonggi Northern Provincial Police Agency launched a full-scale internal investigation to determine the details of the leak and whether any internal personnel were involved.

The incidents have raised concerns about South Korea’s Bitcoin custody practices, just as the country prepares for the Second Phase of the Virtual Asset User Protection Act, which is expected to serve as a comprehensive framework for the entire industry.

Financial authorities are also conducting an inspection of local exchanges’ internal controls following the “ghost Bitcoin” incident at Bithumb. Earlier this month, the crypto exchange accidentally distributed 620,000 BTC, worth over $40 billion, to 249 users due to an employee’s mistake.

Bithumb’s system failed to block the transaction and distributed assets that did not actually exist, distorting market prices. Lawmakers highlighted that the incident exposed “structural vulnerabilities” in the sector that must be addressed in the upcoming legislation.

The Financial Services Commission (FSC) announced last month that it is studying a proposal for prosecution measures against suspects of crypto asset price manipulation. Some officials argue it’s necessary “to complement the current Virtual Asset User Protection Act by implementing measures for the confiscation of criminal proceeds or the preservation of recovery funds in advance.”