South Korean prosecutors regain 320.88 BTC after stolen crypto is sent back
South Korean prosecutors confirmed they have recovered seized cryptocurrency after a hacker voluntarily returned Bitcoin stolen from government authorities. According to officials, the returned funds are valued at around $21 million, marking a rare case where stolen digital assets were sent back without prolonged legal action.
Local media reported that a total of 320.88 BTC was transferred on February 17, 2026. The Bitcoin was sent directly to a wallet controlled by the South Korean government. Prosecutors said the recovered assets are now securely held and will be handled according to legal procedures, while investigations continue into how the original breach occurred.
What happened when a hacker returns $21M Bitcoin stolen from South Korean authorities
Local reporting said the Gwangju District Prosecutors’ Office confirmed the Bitcoin was returned to an official wallet on Tuesday and then moved to a secure wallet at a domestic digital-asset exchange controlled by authorities. The return was described as unexpected, and officials did not publicly explain why the funds were sent back.
Background: how the seized Bitcoin went missing in 2025
The Bitcoin was reported missing from prosecutors’ custody after being transferred out to a third-party wallet on Aug. 21, 2025, with investigators and local reporting pointing to a likely phishing-related compromise of access credentials/private keys.
Timeline in the hacker returns $21M Bitcoin stolen from South Korean authorities case
2025-08-21: 320 BTC reportedly transferred out to a third-party wallet.
2026-01 (late): Local reporting describes internal review/investigation around the loss.
2026-02-17: 320.88 BTC reportedly returned to an official wallet.
2026-02-19: Local coverage details the return and ongoing probe.
Authorities say they will keep investigating
Prosecutors have indicated they will continue efforts to identify the suspect and examine related phishing infrastructure (including malicious domains) tied to the incident, even though the assets were returned.
Custody concerns grow after another South Korea police Bitcoin loss report
Separate reporting in February said 22 BTC held as evidence by police in Seoul’s Gangnam area was transferred out of a cold wallet without the physical device being stolen fueling broader questions about how seized digital assets are safeguarded.
Context & Analysis
A voluntary return can happen when cash-out routes narrow (for example, if exchanges freeze addresses or enhanced monitoring increases risk). Still, a returned balance does not by itself establish who controlled the wallet or how access was obtained questions that investigators typically address through device forensics, key-handling logs, and tracing the on-chain path to potential off-ramps.
Final Thoughts
South Korean prosecutors say the 320.88 BTC is back under official control, but the investigation continues to determine how the 2025 custody breach occurred and who controlled the wallet before the funds were returned amid rising scrutiny of how public agencies store and audit seized cryptocurrency.
FAQs
Q : What was returned to South Korean authorities?
A : Local reporting said 320.88 BTC was returned to an official wallet controlled by prosecutors.
Q : When was it returned?
A : Reports said the Bitcoin was returned on Tuesday, Feb. 17, 2026.
Q : How much was it worth at the time?
A : Local coverage put the value at about $21.3 million at the time of reporting.
Q : How did the theft happen originally?
A : Earlier reporting cited a likely phishing-related compromise that exposed credentials or private-key access.
Q : Is the suspect identified?
A : No. Authorities said the investigation continues and no public identification was reported.
Q : Why would a hacker send the Bitcoin back?
A : Officials gave no definitive reason; in some cases, address freezes and cash-out constraints can increase risk for the holder.
Q : What does “hacker returns $21M Bitcoin stolen from South Korean authorities” mean for the case?
A : It means the assets may be recovered, but prosecutors can still pursue charges related to the breach and any phishing infrastructure.
Facts
Event: Seized Bitcoin missing from South Korean prosecutors’ custody is reported returned to an official wallet
Date/Time
2026-02-17T00:00:00+05:00 (return reported on Feb. 17; exact time not publicly specified)Entities
Gwangju District Prosecutors’ Office (South Korea); South Korean police (Gangnam/Seoul, separate 22 BTC report)Figures
320.88 BTC (~$21.3M reported); 22 BTC (~$1.5M reported in separate case)Quotes
“We have launched an internal audit…” prosecution official (earlier reporting on the loss)Sources
See list below