Hacker Returns 320.8 BTC Stolen from South Korean Prosecutors

Highlights:

• South Korean prosecutors recover $21 million in Bitcoin after months of blockchain tracking.
• A phishing attack drained 320.8 BTC from the government prosecutors’ digital wallet in August last year.
• Authorities traced blockchain transfers and forced the return of stolen funds.

On February 19, the Gwangju District Prosecutors’ Office announced that 320.8 Bitcoins had been transferred back from the hacker’s wallet into their official wallet. These coins were originally seized from the daughter of a couple arrested by the Gwangju Metropolitan Police Agency. The couple faced charges for running an illegal overseas gambling operation worth 3.9 trillion Korean won between 2018 and 2021. Investigators revealed that the couple concealed their criminal profits by converting them into Bitcoin, which was later stolen in a phishing attack before being recovered.

🚨JUST IN: HACKER RETURNS $21 MILLION IN STOLEN BITCOIN

South Korean Prosecutors recovered $21 MILLION in Bitcoin after blocking exchange transactions linked to the stolen funds. The hacker’s identity remains unknown. pic.twitter.com/9S7663f9Mg

— Coin Bureau (@coinbureau) February 19, 2026

320.8 BTC Stolen from Gwangju Prosecutors’ Wallet in August

In December, the Gwangju District Prosecutors’ Office realized that the Bitcoin they had seized during a raid on a gambling platform was missing. An internal review revealed the coins had actually been stolen months earlier, in August, when investigators mistakenly entered recovery seed phrases into a phishing website. That error gave hackers access to the wallet and allowed them to drain the funds.

Prosecutors identified the wallets holding the stolen Bitcoin and alerted major crypto exchanges. The exchanges froze related transactions, making it nearly impossible for the hacker to sell or launder the assets. Under mounting pressure, the hacker returned the stolen Bitcoin to the authorities’ wallet on Tuesday, according to local outlet Digital Asset.

Officials moved the returned Bitcoin into secure custody right after receiving it. Prosecutors did not confirm possible charges because the investigation is still ongoing. They also shared no details about the suspects. It is still unclear if the return came from one person or a group.

How the Recovery Effort Worked

After discovering the theft, prosecutors launched a forensic investigation to trace the stolen Bitcoin. Using blockchain analytics, they followed the digital trail as the funds moved across wallets. When suspicious activity appeared, authorities alerted exchanges and asked them to freeze any wallets linked to the stolen coins.

Most hackers try to sell stolen Bitcoin through centralized exchanges. Once the exchanges froze the wallets, the hacker lost the ability to move or liquidate the funds. Such coordination between law enforcement and exchanges is becoming increasingly common in high-profile cryptocurrency heists, as this rapid cooperation makes it more difficult for hackers to exchange their stolen funds.

The recovery of the stolen Bitcoin represents a rare victory in the fight against cryptocurrency crime and provides a number of important lessons. Phishing is a significant risk in the sector. Even senior officials can be deceived by a phishing site. Improved internal controls, security training, and multi-factor authentication are necessary to mitigate this risk. The case also illustrates the benefit of blockchain transparency. Unlike traditional bank transfers, Bitcoin transactions are traceable, and investigators can track stolen money.