Hacker voluntarily returns 320.88 BTC worth $21.3 million stolen from South Korean prosecutors

The Gwangju District Prosecutor’s Office confirmed today that 320.88 BTC, currently worth about $21.5 million, was transferred back into the government’s custody wallet since February 17. 

They also mentioned that the funds were then moved to a secure wallet in a domestic exchange. 

The announcement by South Korean prosecutors is the latest chapter of a bizarre theft even by crypto standards. In a matter of weeks, the Gwangju District Prosecutor’s Office confirmed that a theft occurred on its watch, got 100% of the money back, and they did not catch the thief. 

Actually, they don’t even have a suspect, according to local reports. 

Apparently, the Bitcoin just reappeared in the hard wallet six months after it went missing.

Bitcoin sat untouched for months before mysterious return 

The timeline of events in this story is remarkable. The theft originally happened back in August 2025 when prosecutors fell victim to a phishing attack during their routine custody verification procedures. 

A staff member apparently accessed a fake website designed to look like a legit crypto management platform, and unknowingly exposed the wallet’s seed phrases to attackers who drained the 320 BTC shortly after.

The theft went completely unnoticed for months before prosecutors discovered that the Bitcoin had disappeared on January 23, 2026, during a routine check on seized assets. 

But by then, the theft was already up to six months old, meaning the Bitcoin could have (or should we say should have) been laundered, hidden in privacy protocols, converted into other tokens, or just moved to different other wallets without anyone noticing.

This is unlike how bad actors operate. According to a Cryptopolitan report, citing Global Ledger research, hackers have doubled the speed of laundering funds, using mixers and DeFi to disguise their tracks.

However, blockchain analysts observed that the funds remained mostly stationary after the initial theft. There was no frantic mixing and layering activity from the hacker’s wallet, unlike most other major crypto thefts. 

The Bitcoin sat dormant, as if the thief was either waiting for the attention to die down for an opportunity to cash out safely, or they realized that the $20+ million was too hot.

Gwangju prosecutors say they blocked hackers from cashing out

The South Korean prosecutors attributed the assets’ return to their own intervention strategy after discovering the loss. When Bitcoin was discovered missing in January, the Gwangju office said it immediately sent cooperation requests to all major domestic crypto exchanges, asking them to freeze any transactions involving the specific wallet address that held the stolen funds.

“The hacker appears to have returned all Bitcoin voluntarily due to concerns about being unable to liquidate it,” prosecutors told Chosun Daily. 

The prosecutors’ office emphasized that their investigation remains active. “The investigation into the circumstances of the Bitcoin loss will continue,” officials said. 

Investigations continue as the prosecutors examine phishing websites, malicious domains, and any other digital footprints left by whoever initiated the August hack. However, no suspects have been identified to date.

Recovery defies crypto theft logic

The voluntary return of the Bitcoin is a stark contradiction to basically everything the crypto industry knows about theft recovery. Some have labeled the incident as “one of a kind’, and it might not be far from the truth. It’s incredibly rare for a crypto thief to steal money and return it voluntarily.

According to estimates attributed to enforcement agencies and recovery providers, the global recovery average of stolen assets is roughly 70% when law enforcement and exchanges cooperate on freezing assets, but major hacks yield as low as 0.4%. 

The decentralized nature and anonymity options on the blockchain make this kind of recovery nearly impossible, especially without the offer of a whitehat bounty.

The smartest crypto minds already read our newsletter. Want in? Join them.