Korean police evidence points to escalation in Bitcoin theft case: 22 BTC stolen, two suspects arrested, raising concerns over asset custody security

On February 26, South Korean law enforcement announced the arrest of two suspects suspected of stealing Bitcoin evidence held by the police. The involved assets amount to 22 Bitcoins, valued at approximately $1.5 million at current market prices. These digital assets were initially seized in November 2021 by the Gangnam Police Department during a criminal investigation and have been kept as key evidence for a long time.

South Korean police stated that during a systematic audit of virtual asset custody procedures across law enforcement agencies nationwide, they unexpectedly discovered that the seized Bitcoins had been transferred from the designated address to an external wallet. The investigation revealed that although the cold wallet device storing the private keys is still held by the police, the on-chain assets have been transferred without authorization, exposing potential vulnerabilities in the management process of encrypted asset evidence.

The Northern Gyeonggi Provincial Police Agency officially detained the two suspects on February 25, 2026, on charges of embezzling the digital assets seized by the police. It is still unclear whether the stolen cryptocurrencies have been successfully recovered, and the case is ongoing as authorities track the flow of funds on the blockchain.

Notably, this audit was triggered by another high-profile incident—earlier, the Gwangju District Prosecutor’s Office reported the abnormal disappearance of 320 Bitcoins they had been holding, prompting South Korean regulators to conduct a comprehensive review of law enforcement’s custody mechanisms and security standards for encrypted assets.

To prevent similar incidents, Korean authorities are implementing stricter digital asset evidence management systems, including establishing dual custody mechanisms for wallets, sealing hardware wallets and mnemonic phrases, and planning to entrust the seized cryptocurrencies to professional custody institutions within the year. Regulators pointed out that this case not only involves internal compliance issues but also highlights the urgent need for law enforcement agencies to establish higher-level risk control systems in cold wallet management, private key security, and on-chain asset supervision, serving as a warning for global encrypted asset law enforcement standards.