How a cold wallet turned out not so cold

A story that sounds like the script of a crypto thriller, but actually happened in real life. South Korean police lost 22 bitcoins that had been stored on a cold hardware wallet since 2021. The confiscated coins disappeared unnoticed – and this is already the second such case in the country in just one year.

According to The Block, the incident took place in the Gangnam district of Seoul. The local police department discovered that 22 BTC were missing from a confiscated hardware wallet – at the current rate, that is about $1.46 million. An internal investigation has now begun to determine exactly how the leak occurred and whether employees may have been involved.

The coins had been sitting there since 2021 – and no one noticed. The bitcoins were confiscated and officially handed over to the police back in November 2021. Since then, they were stored as physical evidence. But the key point is that the investigation connected to them was suspended, and the assets were essentially just lying there as “dead weight.”

This, according to media reports, is exactly why the disappearance went unnoticed. No one regularly checked the wallet’s status, monitored transactions, or conducted audits. As a result, the coins were discovered missing only years later.

The device is still there, but the money is gone. One particularly alarming detail: the hardware wallet itself, where the access keys were stored, was not stolen. It remained in place. That means the attacker did not physically remove the device from storage – they managed to withdraw the bitcoins remotely by gaining access to the private keys or the seed phrase.

This means it was not a classic “safe theft,” but a compromise of access. And in such stories, an uncomfortable question always arises: who knew where the keys were, and who had the opportunity to use them?

A nationwide audit after an even bigger loss. The disappearance of 22 BTC was not discovered by chance, but during a nationwide inspection of investigative agencies. This audit began after a much more high-profile case: the прокуратура of the city of Gwangju recently lost 320 BTC – about $21.4 million.

That incident became known in January. Preliminary data suggests the bitcoins disappeared back in July, but it was only noticed months later. Local media reported that staff responsible for storing evidence visited a phishing site. After that, the cryptocurrency was withdrawn. So the problem is not isolated – it is systemic.

Government agencies and crypto: the weak link. Both cases show how vulnerable state institutions can be when it comes to storing digital assets. Confiscating bitcoin is one thing. Safely holding it for years, following access protocols, separation of responsibility, regular audits, and protection from social engineering is something entirely different.

A cold wallet alone does not guarantee security. If the seed phrase is written on paper in the same office, if multiple people have access, if there is no multi-layer control, then “cold storage” becomes just a nice label.

What happens next? Now the Gangnam police are trying to reconstruct the chain of events: who had access, when the keys could have been compromised, and where the funds went. But as always with blockchain, the issue is that transactions are irreversible. If the coins were sent to addresses that quickly passed through mixers or exchanges without KYC, recovering them will be extremely difficult.

This story is yet another reminder: cryptocurrency is an asset that requires a different storage culture. You cannot simply “put it in a safe and forget it.” Because in the digital world, forgotten bitcoins sometimes disappear on their own – or rather, someone very carefully takes them.

South Korea now has two major cases in one year. And it seems that government structures will have to learn to handle crypto as seriously as large exchanges and custodial services do. Otherwise, the next missing wallet may be even more expensive.