Connect with us
DAPA Banner

Crypto World

South Korea National Tax Service’s Mistake Resulted In $4.8 Million Crypto Loss

Published

on

South Korea National Tax Service’s Mistake Resulted In $4.8 Million Crypto Loss

South Korea National Tax Service just made a costly mistake resulting a huge crypto loss.

In an official press release, the agency published unredacted photos that exposed crypto wallet seed phrases. Within hours, an unknown actor used the information to drain 4 million Ethereum-based tokens, nominally worth $4.8 million, from seized wallets before returning them.

The funds were not dumped, but the incident exposes a serious operational security failure. It highlights the risks governments face when handling self-custodied digital assets without proper technical safeguards.

Key Takeaways

  • The Lapse: NTS press materials included high-resolution images of handwritten recovery phrases for seized Ledger hardware wallets.
  • The Asset: 4 million Pre-Retogeum (PRTG) tokens were taken, holding a theoretical value of $4.8 million but near-zero market liquidity.
  • The Outcome: The attacker funded the wallets with ETH for gas, moved the tokens, and eventually returned them to the original address.

The Leak: Tax Agency Publishes Ethereum Private Keys

On February 26, the National Tax Service announced it had seized roughly 8.1 billion KRW, about $5.61 million, from repeat tax delinquents. To showcase the enforcement action, officials released photos of the confiscated items, including a display labeled “Case 3.”

Advertisement
Source: ntw

The problem was in the details. The images showed Ledger hardware wallets next to a sheet of paper with the 12-word seed phrases fully visible.

A local professor described the mistake bluntly, comparing it to publicly inviting someone to empty your wallet. The incident highlights a basic but critical gap in technical handling, especially as authorities increasingly seize and manage digital assets.

On-Chain Data: The Swipe and Return

On-chain data shows the wallets were drained soon after the photos went public. An unknown actor first sent a small amount of ETH to cover gas fees, then transferred 4 million Pre-Retogeum (PRTG) tokens to a new address.

Source: Etherscan

That amount represented roughly 40% of the token’s total supply. While early reports valued the stash at $4.8 million, liquidity tells a different story. The only active trading pair shows minimal volume, and even a small sell order would have crushed the price. Cashing out at scale was nearly impossible.

The tokens were later returned to the original wallets. Whether this was a white-hat action or simple realization that the assets were illiquid is unclear.

Advertisement

The episode highlights a basic custody failure. The original owner used a hardware wallet for security, but that protection was undone when authorities photographed the seed phrase. The NTS has not yet issued a detailed statement, and the incident raises questions about how seized crypto assets will be handled going forward.

Discover: The best new crypto in the world

The post South Korea National Tax Service’s Mistake Resulted In $4.8 Million Crypto Loss appeared first on Cryptonews.

Source link

Advertisement
Continue Reading
Click to comment

You must be logged in to post a comment Login

Leave a Reply

Crypto World

Friday’s eth.limo Hijack Caused by Social Engineering on EasyDNS

Published

on

Friday’s eth.limo Hijack Caused by Social Engineering on EasyDNS

Ethereum Name Service gateway eth.limo has revealed that the domain hijacking on Friday was caused by a social engineering attack directed against EasyDNS, its domain name service provider. 

According to a postmortem published by eth.limo on Saturday, an attacker impersonated one of its team members to initiate an account recovery process with easyDNS, granting access to the eth.limo account and allowing them to alter domain settings.

“The NS records were changed and directed to Cloudflare… Once we understood that a DNS hijack had taken place, we immediately notified the community as well as Vitalik Buterin and others. We then began contacting EasyDNS in an attempt to respond to the incident,” the company said.

Eth.limo serves as a Web2 bridge, providing access to around 2 million decentralized websites using the .eth domain name. Hijacking the service could allow an attacker to redirect users to malicious websites. Ethereum co-founder Vitalik Buterin warned users Friday to avoid his blog until the incident was resolved.

Advertisement

Mark Jeftovic, CEO of easyDNS, has publicly accepted responsibility for the incident in its own postmortem report. 

“We screwed up and we own it,” said Jeftovic on Saturday. 

“This would mark the first successful social engineering attack against an easyDNS client in our 28-year history. There have been countless attempts.”  

Both companies have pointed to the Domain Name System Security Extension (DNSSEC) in thwarting the hacker’s attempts to do further damage. 

The attacker couldn’t produce valid cryptographic signatures, so Domain Name System resolvers rejected the attacker’s forged DNS responses, causing users to see error messages instead of being redirected to malicious sites. 

Advertisement

“DNSSEC was enabled for their domain when the attackers attempted to flip their nameservers, presumably to effect some manner of phishing or malware injection attack, DNSSEC-aware resolvers, which most are these days, began dropping queries,” Jeftovic said. 

Source: eth.limo

In its postmortem, eth.limo noted that because the attacker lacked the signing keys, they were unable to bypass the safeguards, which likely “reduced the blast radius of the hijack. We are not aware of any user impact at this time. We will provide updates if that changes.”

easyDNS makes changes since the attack

Jeftovic described the social engineering attack as “highly sophisticated,” and said easyDNS is still conducting a post-mortem on how the breach occurred, and has already begun rolling out changes to prevent a recurrence.

Source: easyDNS

“In eth.limo’s case, we will be migrating them to Domainsure, which has a security posture more suited toward enterprise and high-value fintech domains, TLDR there is no mechanism for an account recovery on Domainsure, it’s not a thing,” he added.

“On behalf of everyone here, I apologize to the eth.limo team and the wider Ethereum community. ENS has always had a special place in our heart as the first registrar to enable ENS linking to web2 domains and we’ve been involved in the space since 2017.”

Related: RaveDAO denies manipulation as Binance, Bitget probe RAVE trading activity

Advertisement

The eth.limo incident is the latest in a series of domain hijackings targeting crypto projects. Days earlier, decentralized exchange aggregator CoW Swap lost control of its website after an unknown party hijacked its domain. 

Steakhouse Financial, a DeFi advisory and research firm, similarly disclosed at the end of March that it had lost control of its domain to an attacker.

Magazine: Will the CLARITY Act be good — or bad — for DeFi?