South Korean authorities released the password from a hardware wallet

South Korean tax authorities they lost millions in seized cryptocurrencies after publishing high-resolution photos of Ledger hardware wallets that displayed the wallets' seed phrases, allowing an attacker to drain the funds.

South Korea's National Tax Service seized cryptocurrencies during recent law enforcement operations against 124 high-profile tax evaders. But a large portion of those cryptocurrencies went missing.

See more articles from iGuRu.gr when you search for news on Google.

The authorities’ operation initially resulted in the seizure of approximately 8,1 billion won, or about $5,6 million, worth of cryptocurrency. However, officials later issued a press release to showcase these efforts to recover unpaid taxes, and the release included photos of Ledger hardware wallets that were seized along with handwritten notes showing the wallets’ seed phrases.

These images attached to the press release proved to be the critical flaw. The high-resolution photos clearly showed the recovery phrases, which serve as the master key to accessing the wallets. This exposure eliminated any protection provided by offline cold storage on Ledger devices. Possession of the seed phrase allows for complete control, and anyone who knows the phrase can enter it into a software or other hardware wallet to initiate transfers without the original device.

In this case, an unknown individual saw the photos released by law enforcement, first deposited a small amount of ether into one of the addresses to cover the Ethereum network fees necessary for outgoing transactions.

He then executed three transfers and moved approximately 4 million Pre-Retogeum, or PRTG, tokens. These tokens were worth $4,8 million.


Google preferences

Leave a Comment

Your email address will not be published. Required fields are marked *

Your message will not be published if:
1. Contains insulting, defamatory, racist, offensive or inappropriate comments.
2. Causes harm to minors.
3. It interferes with the privacy and individual and social rights of other users.
4. Advertises products or services or websites.
5. Contains personal information (address, phone, etc.).