320 BTC Phishing Case: Flow Analysis of a $29M Custody Failure

The theft was massive in scale. In August 2025, 320 bitcoins worth about 40 billion won ($28 million) were stolen during a routine internal check of a hardware wallet. The loss occurred when prosecutors accessed a phishing site disguised as a legitimate checking platform, siphoning the assets without verifying the wallet's contents.

The recovery was swift but raised immediate red flags. In late January 2026, all 320 BTC were moved back to the Gwangju District Prosecutors' Office's confiscation wallet after being held by a hacker. This return was not the end of the story; it was the start of a suspicious flow.

The pattern that followed is highly unusual. Just two hours after the deposit was confirmed, the full 320 BTC was transferred out to a new third-party wallet. This direct re-transfer from the prosecution's own wallet to an external address is not typical for a hacking case and has prompted experts to question whether the recovery was genuine or involved internal action.

The Anomalous Flow Pattern

The immediate re-transfer of the recovered funds is the core anomaly. After the 320 BTC were deposited back into the prosecution's confiscation wallet, all 320 BTC were moved again just two hours later. This pattern-returning stolen assets to the victim's wallet only to immediately re-transfer them-is not standard for external hackers, who typically use mixing services to obscure trails. The flow suggests the funds may have been moved internally, raising the possibility of "self-creation, not hacking."

This sequence creates a critical audit gap. The direct transfer from the prosecution's own wallet to a new third-party address severs the clear chain of custody. It becomes extremely difficult to prove the original loss was a genuine hack versus an internal misappropriation, as the evidence of the theft's final destination is now obscured by this suspicious re-transfer.

The incident exposes a severe vulnerability in how government agencies manage high-value digital assets. The case reveals a two-year window of negligence where access credentials were not updated for over 24 months. The subsequent flow of funds demonstrates that even when assets are recovered, the institutional controls for their custody are insufficient, leaving them exposed to manipulation or loss.

Catalysts and What to Watch

The primary catalyst is the ongoing internal investigation by the Gwangju District Prosecutors' Office. Five inspectors are under audit for the August 2025 theft, and the probe is examining their mobile phones and materials. The outcome will determine if criminal liability follows, but the investigation's findings on the final flow of the 320 BTC are critical for resolving the self-creation theory.

Watch for the official report detailing the investigation's conclusions. The key metrics to monitor are the final destination of the recovered funds and any evidence of internal collusion. The suspicious re-transfer pattern-where the full amount moved from the prosecution's wallet to a third-party address within two hours-must be explained. The absence of initial evidence of internal collusion is noted, but the report's depth will be the true test.

In the regulatory sphere, monitor for any legislative proposals in South Korea mandating stricter security standards for government-held cryptocurrency custody. The case's core failure was a two-year window of negligence where access credentials were not updated for over 24 months. This incident has already prompted calls for a review of management systems, and new rules could be introduced to prevent similar lapses in future government digital asset seizures.