South Korea's Crypto Custody Crisis: $6M+ Lost, $42.5M Seized, and a Failed Tender

The scale of security failures is stark. In February 2025, the National Tax Service (NTS) lost approximately $4.6 million in a single breach, a catastrophic error that exposed a mnemonic code in a public press release. This followed a 2022 incident where Seoul police lost more than $1.4 million in Bitcoin by failing to control private keys for seized assets. These two thefts represent a direct, multi-million dollar bleed from public custody.

The total portfolio at risk is even larger. Over the past five years, South Korean police have seized virtual assets valued at approximately 54.5 billion won, which translates to roughly $42.5 million at current prices. Bitcoin dominates this portfolio, accounting for about 50.7 billion won, or roughly 93% of the total seized value. This massive concentration of high-value, unsecured assets created a clear vulnerability.

The government's draft rules are a direct reaction to this catastrophic money flow. The recent completion of a draft ordinance, which for the first time includes guidelines for managing privacy coins, is a legislative response to years of mismanagement. The plan to select private custody institutions this year is an acknowledgment that internal controls have repeatedly failed, and that professional third-party custody is now a necessity to protect seized assets.

The Custody Bottleneck: Failed Tenders and the $83M Budget

The operational path to secure custody is blocked by budget and scale. Three previous attempts to select private custodians have failed, primarily due to a limited budget of only 83 million KRW and the small number of qualified institutions. This budget constraint created a vicious cycle: low bids from a narrow pool of providers led to rejected tenders, delaying the critical transfer of custody.

The immediate plan is to break this logjam. The National Police Agency aims to select private custodial institutions by the first half of this year. This accelerated timeline reflects the urgency of moving seized assets off vulnerable internal systems, but it also pressures the agency to work within the same tight financial and market constraints that derailed past efforts.

Adding complexity is a new directive. For the first time, the draft rules include specific guidance on privacy coins and software wallets. Managing these high-anonymity assets requires specialized protocols, increasing the technical and operational burden on any selected custodian. This new layer of complexity makes finding a qualified, affordable partner even harder.

The expert consensus is clear. Given the repeated failures and the high stakes, the solution is a government-led unified system. A professional, centralized custodial platform would bypass the fragmented tender process, ensure consistent security standards, and finally close the loop on a multi-million dollar security failure.

Catalysts and Risks: The Selection Deadline and Market Implications

The immediate catalyst is the selection deadline. The National Police Agency plans to select private custodial institutions by the first half of this year. This timeline is the critical next step to move the approximately 54.5 billion won in seized assets off vulnerable internal systems.

The primary risk is failure to find a qualified partner. Given that three prior tender processes failed due to a limited budget of only 83 million KRW and a small pool of qualified institutions, the agency faces a high hurdle. A delay would leave the roughly $42.5 million portfolio exposed, repeating the catastrophic lapse seen in 2022 when police lost more than $1.4 million in Bitcoin due to poor custody.

A secondary risk is inconsistent adoption and enforcement. The draft rules now include specific guidance for managing privacy coins, a new layer of complexity. Yet, the prior custody failure shows that even when guidelines exist, internal adherence is not guaranteed. This creates a vulnerability for the new, more complex protocols.

The shift toward managing privacy coins is a catalyst for more sophisticated asset handling, but it does not change the core operational risk. The real vulnerability remains the custody process itself. The agency's plan to select private custodians is a direct attempt to mitigate that risk, but the repeated tender failures underscore how difficult and costly that transition will be.