22 BTC held by Seoul’s Gangnam Police Station leaking out while it was in investigative custody. The cold wallet device itself was not physically stolen, but the BTC inside was transferred out, and authorities are now tracing the internal transfer path and any potential internal involvement

The BTC was originally obtained via voluntary submission during a 2021 investigation, but the underlying case later paused, leaving the asset in long-term custody. The same report says the value of the missing 22 BTC was around 2.1 billion won at the time it was discovered.

A key point in both accounts is the distinction between theft of a device and loss of funds. The storage medium remained, yet the balance did not. That framing typically implies credential compromise, unauthorized access, or procedural failure in how keys and signing are handled, rather than a simple break-in.

Why This Matters

Custody failures by state authorities become headline risk quickly because they touch both enforcement credibility and policy direction. When seized assets leak under government custody, regulators and legislators often respond with tighter standards for how digital assets are stored, audited, and accessed.

This is not only a reputational issue. It can influence future seizure and forfeiture workflows. If agencies cannot demonstrate robust key management, approvals, and audit trails, courts and oversight bodies may push for stricter separation of duties, external audits, and defined custody frameworks that resemble institutional custody practices.

The Gangnam case also lands in a sensitive sequence. Dong-a Ilbo links the discovery to a nationwide inspection triggered by a separate incident in which 320 BTC held by the Gwangju District Prosecutors’ Office was found missing after the fact. In both cases, the narrative is similar: the storage device remained, while the coins moved out. That similarity strengthens the view that the risk is structural, not isolated to one office or one team.

How A “Leak” Can Happen Without A Stolen Wallet

When a cold wallet is described as “still there” but funds are gone, the most common failure mode is not physical theft. It is access-path leakage. That can include a seed phrase or private key being stored insecurely, credentials being exposed during wallet setup, or a signing workflow that allows one person to move funds without robust oversight.

Another common weakness is operational drift over time. When a case pauses and assets sit idle, teams rotate, documentation gets stale, and periodic balance checks may stop. A wallet can become a “forgotten vault” where unauthorized activity goes unnoticed, especially if monitoring is manual and not tied to an immutable audit log.

Finally, there is the human layer. If investigators are probing internal involvement, they are typically checking who had knowledge of the wallet’s existence, where recovery materials were kept, and whether any transfers align with staff access windows or device connection logs.

What To Watch Next

The next meaningful details will come from the on-chain trail and how quickly it narrows. Investigators will likely focus on the exact timeline of movements, whether the 22 BTC touched exchanges, and whether any portion moved through laundering infrastructure such as mixers or chain-hopping patterns. Those hops can reduce recoverability if alerts and freezes do not happen fast.

For now, the signal is clear and narrow: an official unit confirmed a custody leak, the transfer path is under investigation, and the case is being discussed in the context of broader inspection findings and prior seized-asset losses.

The post South Korean Police Confirm 22 BTC Custody Leak, Probe Internal Transfers appeared first on Crypto Adventure.

---

Filed under: Bitcoin - @ February 16, 2026 2:05 pm