How Did 320 Bitcoin Reappear in Government Custody?

South Korean prosecutors say they have recovered more than 320 Bitcoin that went missing from government custody in 2025 after the cryptocurrency was sent back to an official wallet this week, according to local media reports.

The Gwangju District Prosecutors’ Office recovered 320.88 BTC, valued at about $21.3 million at current prices, local outlet The Chosun Daily reported. Prosecutors confirmed that the unidentified hacker transferred the stolen Bitcoin back to the authorities’ wallet on Tuesday. The funds were later moved to a secure wallet at a domestic digital exchange controlled by authorities.

The Bitcoin had disappeared in August 2025 while under prosecutorial custody during an investigation. The loss was discovered months later, on Jan. 23, during a routine inspection of seized financial assets. Authorities attributed the theft to a phishing attack that exposed access credentials linked to the wallet.

Investor Takeaway

Even state-held crypto assets are vulnerable to operational security failures, reinforcing the importance of credential management and layered custody controls.

Why Was the Bitcoin Returned?

Prosecutors have not explained why the 320.88 BTC was returned. Officials said they had sent cooperation letters to domestic exchanges requesting that they freeze the hacker’s wallet address. Those steps may have made it difficult to liquidate or move the funds through compliant trading venues.

Without access to exchanges, off-ramping large amounts of Bitcoin can become operationally complex and traceable. The return suggests either mounting pressure on the holder of the stolen assets or a calculation that retaining them had become impractical.

Authorities said the investigation is ongoing and that efforts to identify the person responsible will continue. “We will do our best to arrest the suspect regardless of the recovery of the bitcoin,” the prosecutors’ office told local outlet Digital Asset Works.

What Other Custody Breaches Have Occurred?

The recovery comes shortly after another incident involving seized crypto. About a week earlier, 22 Bitcoin — valued at roughly $1.5 million at the time — were transferred externally from a cold wallet held by Seoul police, according to earlier reports.

Authorities said the physical cold wallet device was not stolen, but the 22 BTC were moved out regardless. That disclosure renewed scrutiny over how law enforcement agencies safeguard confiscated digital assets, especially when holdings remain in custody for extended periods.

The 22 Bitcoin had been voluntarily submitted during an investigation in November 2021. Following the transfer, the Gyeonggi Northern Provincial Police Agency launched a new probe to identify those involved and determine how the assets were moved.

Investor Takeaway

The back-to-back incidents highlight that institutional custody risk is not limited to exchanges or private firms. Public-sector asset management practices can also face technical and procedural weaknesses.

What Does This Mean for Government Crypto Custody?

Law enforcement agencies increasingly hold digital assets seized in fraud, hacking, and financial crime investigations. Those holdings can run into tens or hundreds of millions of dollars, turning public bodies into de facto crypto custodians.

The August 2025 theft exposed how phishing and credential exposure can compromise even official wallets. The subsequent return of 320.88 BTC reduces the financial impact, but it does not resolve the structural questions around access controls, key management, and internal oversight.

With Bitcoin trading near $66,500, the scale of assets under custody amplifies operational risk. As investigations into both the returned 320 BTC and the missing 22 BTC continue, scrutiny is likely to focus on how digital evidence and seized crypto are stored, monitored, and audited.

For now, prosecutors have regained control of the bulk of the missing funds. The identity of the individual responsible — and the motive behind returning the Bitcoin — remains under investigation.

Author