Change Of Heart? Hacker Returns $21M Stolen Bitcoin To South Korean Prosecutors

bitcoinistPublished on 2026-02-20Last updated on 2026-02-20

Abstract

A hacker has returned 320.8 Bitcoin (BTC), worth $21 million, to South Korean prosecutors after stealing it in a phishing attack in August. The funds were originally seized during a 2021 illegal gambling investigation and were lost when investigators mistakenly accessed a phishing site. Authorities believe pressure from blocking transactions and requesting cooperation from exchanges led to the return. Despite the recovery, the Gwangju District Prosecutors’ Office pledged to continue investigating to apprehend the perpetrators. This incident, along with another loss of 22 BTC at a Seoul police station, has raised concerns about South Korea’s custody of virtual assets. The country is preparing for the Second Phase of the Virtual Asset User Protection Act to address such vulnerabilities. Recent issues, including a "ghost Bitcoin" error at Bithumb that distributed non-existent assets, have prompted financial authorities to inspect exchanges and consider stronger prosecution measures for crypto crimes.

A hacker has returned 320 Bitcoin (BTC) stolen from South Korean prosecutors throughout a phishing scam last year. As authorities face backlash over repeated incidents, officers have pledged to continue the investigation to uncover the full details and strengthen their custody practices.

Stolen Bitcoin Returned To Gwangju Prosecutors

On Thursday, the Gwangju District Prosecutors’ Office announced it recovered 320.8 Bitcoin lost in August to a phishing attack after the malicious actors willingly sent back the assets earlier this week.

Local news outlet Digital Asset reported on Tuesday that the on-chain data showed the lost BTC, worth $21 million, had been transferred to a wallet managed by South Korean authorities. The assets were seemingly moved through multiple addresses before being transferred to a domestic crypto exchange wallet.

As reported by Bitcoinist, South Korean prosecutors faced backlash last month after discovering that a large stash of seized BTC had gone missing months ago. Authorities reportedly learnt of the loss during a routine check of seized financial assets held as criminal evidence.

After an internal review, prosecutors found that the crypto assets were lost to a scam in August during the handling of the sized assets. Reportedly, malicious actors drained the wallets after investigators mistakenly accessed a phishing website.

Notably, the lost Bitcoin was originally seized during a 2021 investigation into an illegal gambling website. Prosecutors launched an investigation after discovering the incident. They also took measures to recover the assets, including blocking transactions from the perpetrator’s address to domestic exchanges and sending cooperation requests to overseas exchanges.

According to the report, authorities believe that these measures exerted pressure on the hackers, ultimately pushing them to return the funds. Meanwhile, prosecutors are currently continuing to track down the malicious actors while also conducting related investigations and inspections.

“(Regardless of the recovery of the Bitcoin), we will do our utmost to apprehend the perpetrators in the future,” The Gwangju District Prosecutors’ Office stated. “We plan to continue conducting a rigorous investigation to clearly uncover the full details of the case.”

Authorities Slammed Over Repeated Incidents

The Gwangju incident has led to a nationwide review of law enforcement’s handling of virtual assets. The review has revealed another security breach at the Seoul Gangnam Police Station.

Last Friday, the Gangnam station announced it had lost 22 BTC that were voluntarily submitted to authorities during an investigation in November 2021. According to local reports, the leak had not been detected until now, since the investigation into that case had been suspended.

The inspection revealed that the cold wallet storing the Bitcoin was not stolen, but the assets stored inside “had vanished without a trace.” As a response, the Gyeonggi Northern Provincial Police Agency launched a full-scale internal investigation to determine the details of the leak and whether any internal personnel were involved.

The incidents have raised concerns about South Korea’s Bitcoin custody practices, just as the country prepares for the Second Phase of the Virtual Asset User Protection Act, which is expected to serve as a comprehensive framework for the entire industry.

Financial authorities are also conducting an inspection of local exchanges’ internal controls following the “ghost Bitcoin” incident at Bithumb. Earlier this month, the crypto exchange accidentally distributed 620,000 BTC, worth over $40 billion, to 249 users due to an employee’s mistake.

Bithumb’s system failed to block the transaction and distributed assets that did not actually exist, distorting market prices. Lawmakers highlighted that the incident exposed “structural vulnerabilities” in the sector that must be addressed in the upcoming legislation.

The Financial Services Commission (FSC) announced last month that it is studying a proposal for prosecution measures against suspects of crypto asset price manipulation. Some officials argue it’s necessary “to complement the current Virtual Asset User Protection Act by implementing measures for the confiscation of criminal proceeds or the preservation of recovery funds in advance.”

Bitcoin trades at $66,198 in the one-week chart. Source: BTCUSDT on TradingView

Related Questions

QHow much Bitcoin was returned to the Gwangju District Prosecutors' Office by the hacker?

A320.8 BTC, worth $21 million.

QWhat was the original source of the stolen Bitcoin that was returned?

AThe Bitcoin was originally seized during a 2021 investigation into an illegal gambling website.

QWhat action did authorities take that they believe pressured the hackers into returning the funds?

AThey blocked transactions from the perpetrator's address to domestic exchanges and sent cooperation requests to overseas exchanges.

QBesides the Gwangju incident, which other law enforcement agency reported a security breach involving Bitcoin?

AThe Seoul Gangnam Police Station reported losing 22 BTC that were voluntarily submitted during an investigation.

QWhat major event at a South Korean crypto exchange is mentioned as raising concerns about internal controls?

ABithumb accidentally distributed 620,000 'ghost' BTC (worth over $40 billion) to 249 users due to an employee's mistake.

Related Reads

The Gold Buy-on-the-Dip Guide: Watch Interest Rates, Not Just War

"Gold Buying Guide: Focus on Interest Rates, Not Just War" Four months ago, gold buyers likely didn't anticipate buying at a peak that even a war couldn't sustain. After hitting a record high of $5,596 on January 29, gold entered a bear market just 91 days later, its fastest decline since 2008. A key trigger was the Fed's hawkish shift, highlighting that monetary policy, not geopolitics, is the primary driver. The article argues that the traditional "buy gold in turmoil" script has changed. While the US-Iran conflict initially boosted prices, the sustained rally in oil prices heightened inflation fears, forcing central banks to maintain or consider tighter policy. Since gold yields no interest, higher rates increase its opportunity cost, eroding its appeal. This dynamic was evident when gold fell sharply on May 18 despite positive peace talks, as lower oil prices eased inflation and thus rate hike pressures. The recent sell-off is also part of a broader market deleveraging. Correlations between gold, Nasdaq, and Bitcoin spiked as leveraged investors sold liquid assets to cover losses, creating a synchronized downturn. Historically, gold bottoms align with policy shifts, not conflict resolutions. The 2008 and 2022 bear markets ended with shifts to extreme easing and peak inflation expectations, respectively. For potential buyers, the author suggests monitoring three signals: 1) Peak interest rate hike expectations, 2) Reopening of the Strait of Hormuz (to ease oil/inflation pressure), and 3) A return to net inflows for Gold ETFs, indicating the end of forced selling. While predicting the exact bottom is impossible, the author's personal strategy involves scaling into a position across price levels like $4000, $3700, and $3500, committing no more than 30% of the intended total allocation initially, and adding the remainder only if key signals emerge. The core conclusion: In turbulent times, watching interest rates is more crucial than watching wars.

marsbit8m ago

The Gold Buy-on-the-Dip Guide: Watch Interest Rates, Not Just War

marsbit8m ago

Recent On-Chain Review: No Clear Narrative Under U.S. Stock Market Pressure, Just Hype

This article analyzes the current state of the Solana meme coin and community token ecosystem, highlighting a market caught between two dominant forces: attention-based PvP and a gradual return to community-centric projects. The first part explores the "Attention PvP" dynamic, where success is driven by celebrity endorsements, viral events, and speed. Examples include $JOTCHUA, which surged after its meme creator's social media activity, and $WORLDCUP, which outperformed a similar Base chain project ($PITCH) largely due to influencer support. The recent "pump.fun GO" feature, allowing bounty tasks for token promotion, is critiqued for fostering sensationalist and often negative stunts—like people getting token tickers tattooed on their bodies for rewards—reminiscent of old internet shock content. In contrast, the article points to a resurgence of organic, community-driven tokens that survive market volatility through strong holder bases and shared ideology, not just hype. Influencer Ansem is cited, arguing that durable meme coins rely on communities willing to endure losses and promote their core message daily. Examples given are older tokens like $neet (anti-work ethos), $troll, $buttcoin, and $triplet, which have maintained relative price stability. A prime example of this community-build model is the new project $KINS, the token for the browser-based MMORPG Kintara. Its success stems not from advanced graphics but from consistently delivering updates, fostering player trust, and creating genuine engagement (e.g., in-game economies, events, property auctions). It has attracted a growing player base and even notable KOLs as participants, demonstrating that sustainable growth can come from building trust rather than orchestrating pumps. The article concludes by questioning whether the market is ultimately a game of mutual trust or mutual deception, expressing hope that such reflection might lead to a healthier ecosystem.

marsbit8m ago

Recent On-Chain Review: No Clear Narrative Under U.S. Stock Market Pressure, Just Hype

marsbit8m ago

On-Chain Scene on Opening Day: $20 Billion Already Staked, How Do On-Chain Contracts Know Who Wins?

On the opening day of the 2026 World Cup, over $2 billion had already been wagered on just the "tournament winner" contracts on platforms like Polymarket and Kalshi. This article explores how these blockchain-based prediction markets actually function once the games begin. It breaks down the massive volume and explains how single-game and tournament-long contracts are priced, with values moving between 1-99 cents to reflect implied probabilities. A key mechanism highlighted is "elimination zeroing," where a team's "champion yes" contract immediately settles to zero once they are mathematically eliminated. The core technical question answered is: how does a smart contract "know" who won a real-world match? The answer lies in oracles. The article details two primary paradigms: UMA's "optimistic oracle" (used by most of Polymarket), which allows a challenge period after a proposed result, and Chainlink's multi-source data aggregation (used by FIFA partners like ADI Predictstreet), which automates settlement with minimal dispute windows. Finally, the article injects a note of caution, citing research estimating that a significant portion of historical trading volume on these platforms might be "wash trading" to inflate numbers. It concludes by contrasting the legal status of these "event contracts" under CFTC rules in the U.S. versus traditional, state-regulated sports betting. As the tournament progresses, the real-time operation of this multi-billion dollar machine—its settlements, eliminations, and underlying mechanisms—becomes a story as compelling as the football itself.

marsbit23m ago

On-Chain Scene on Opening Day: $20 Billion Already Staked, How Do On-Chain Contracts Know Who Wins?

marsbit23m ago

Sequoia Dialogue with Jensen Huang: Computing Model Undergoes a 60-Year Transformation; You Won't Be Replaced by AI, But You Will Be Dimensionality-Reduced by 'Those Who Master AI'

NVIDIA founder and CEO Jensen Huang, in a conversation with Sequoia Capital's Konstantine Buhler, argues that we are witnessing the most significant computing shift in 60 years—from retrieval-based to generative computing. Instead of just storing and retrieving data, future systems will generate highly personalized content (text, images, video) on demand, powered by massive "AI factories." Huang envisions a global "intelligence network" that will envelop the planet, following the historical patterns of energy and communication grids. He outlines a five-layer investment framework: 1) Energy, 2) Chips/Computers, 3) Infrastructure (data centers), 4) AI Models, and 5) Applications. He predicts this ecosystem will reach a scale of $20 trillion annually. Crucially, Huang pushes back against fears of AI-driven job loss. He distinguishes between specific "tasks" (e.g., typing, analyzing images) and overall "jobs" (e.g., CEO, radiologist). While AI automates tasks, it increases efficiency and demand for the higher-value problem-solving aspects of professions, thus creating more jobs and "up-leveling" careers. The real risk, he asserts, is not being replaced by AI, but being outperformed by someone who effectively leverages it. He urges everyone to embrace AI as a tool for augmented capability and innovation.

marsbit1h ago

Sequoia Dialogue with Jensen Huang: Computing Model Undergoes a 60-Year Transformation; You Won't Be Replaced by AI, But You Will Be Dimensionality-Reduced by 'Those Who Master AI'

marsbit1h ago

Trading

Spot
Futures

Hot Articles

What is $BITCOIN

DIGITAL GOLD ($BITCOIN): A Comprehensive Analysis Introduction to DIGITAL GOLD ($BITCOIN) DIGITAL GOLD ($BITCOIN) is a blockchain-based project operating on the Solana network, which aims to combine the characteristics of traditional precious metals with the innovation of decentralized technologies. While it shares a name with Bitcoin, often referred to as “digital gold” due to its perception as a store of value, DIGITAL GOLD is a separate token designed to create a unique ecosystem within the Web3 landscape. Its goal is to position itself as a viable alternative digital asset, although specifics regarding its applications and functionalities are still developing. What is DIGITAL GOLD ($BITCOIN)? DIGITAL GOLD ($BITCOIN) is a cryptocurrency token explicitly designed for use on the Solana blockchain. In contrast to Bitcoin, which provides a widely recognized value storage role, this token appears to focus on broader applications and characteristics. Notable aspects include: Blockchain Infrastructure: The token is built on the Solana blockchain, known for its capacity to handle high-speed and low-cost transactions. Supply Dynamics: DIGITAL GOLD has a maximum supply capped at 100 quadrillion tokens (100P $BITCOIN), although details regarding its circulating supply are currently undisclosed. Utility: While precise functionalities are not explicitly outlined, there are indications that the token could be utilized for various applications, potentially involving decentralized applications (dApps) or asset tokenization strategies. Who is the Creator of DIGITAL GOLD ($BITCOIN)? At present, the identity of the creators and development team behind DIGITAL GOLD ($BITCOIN) remains unknown. This situation is typical among many innovative projects within the blockchain space, particularly those aligning with decentralized finance and meme coin phenomena. While such anonymity may foster a community-driven culture, it intensifies concerns about governance and accountability. Who are the Investors of DIGITAL GOLD ($BITCOIN)? The available information indicates that DIGITAL GOLD ($BITCOIN) does not have any known institutional backers or prominent venture capital investments. The project seems to operate on a peer-to-peer model focused on community support and adoption rather than traditional funding routes. Its activity and liquidity are primarily situated on decentralized exchanges (DEXs), such as PumpSwap, rather than established centralized trading platforms, further highlighting its grassroots approach. How DIGITAL GOLD ($BITCOIN) Works The operational mechanics of DIGITAL GOLD ($BITCOIN) can be elaborated on based on its blockchain design and network attributes: Consensus Mechanism: By leveraging Solana’s unique proof-of-history (PoH) combined with a proof-of-stake (PoS) model, the project ensures efficient transaction validation contributing to the network's high performance. Tokenomics: While specific deflationary mechanisms have not been extensively detailed, the vast maximum token supply implies that it may cater to microtransactions or niche use cases that are still to be defined. Interoperability: There exists the potential for integration with Solana’s broader ecosystem, including various decentralized finance (DeFi) platforms. However, the details regarding specific integrations remain unspecified. Timeline of Key Events Here is a timeline that highlights significant milestones concerning DIGITAL GOLD ($BITCOIN): 2023: The initial deployment of the token occurs on the Solana blockchain, marked by its contract address. 2024: DIGITAL GOLD gains visibility as it becomes available for trading on decentralized exchanges like PumpSwap, allowing users to trade it against SOL. 2025: The project witnesses sporadic trading activity and potential interest in community-led engagements, although no noteworthy partnerships or technical advancements have been documented as of yet. Critical Analysis Strengths Scalability: The underlying Solana infrastructure supports high transaction volumes, which could enhance the utility of $BITCOIN in various transaction scenarios. Accessibility: The potential low trading price per token could attract retail investors, facilitating wider participation due to fractional ownership opportunities. Risks Lack of Transparency: The absence of publicly known backers, developers, or an audit process may yield skepticism regarding the project's sustainability and trustworthiness. Market Volatility: The trading activity is heavily reliant on speculative behavior, which can result in significant price volatility and uncertainty for investors. Conclusion DIGITAL GOLD ($BITCOIN) emerges as an intriguing yet ambiguous project within the rapidly evolving Solana ecosystem. While it attempts to leverage the “digital gold” narrative, its departure from Bitcoin's established role as a store of value underscores the need for a clearer differentiation of its intended utility and governance structure. Future acceptance and adoption will likely depend on addressing the current opacity and defining its operational and economic strategies more explicitly. Note: This report encompasses synthesised information available as of October 2023, and developments may have transpired beyond the research period.

363 Total ViewsPublished 2025.05.13Updated 2025.05.13

What is $BITCOIN

Discussions

Welcome to the HTX Community. Here, you can stay informed about the latest platform developments and gain access to professional market insights. Users' opinions on the price of BTC (BTC) are presented below.

活动图片