The Gwangju District Prosecutors Office liquidated 320.88 Bitcoin in a staged sale that generated about 31.58 billion won, reported as roughly $24.1 million, and transferred the proceeds to the national treasury. The disposal turned recovered crypto linked to criminal activity into a completed cash transfer for the state.
The Bitcoin had been seized from an international illegal gambling operation, stolen in a phishing incident, and later recovered after authorities coordinated with exchanges to freeze potential exit routes. The case brought together asset seizure, theft, recovery, and liquidation in a single episode that exposed both custody weaknesses and recovery capabilities.
Recovery exposed weak points in custody handling
The timeline shows how quickly the situation developed. The theft was discovered in August 2024, prosecutors were notified on February 16, 2025, the funds were recovered by February 19, and the sale was carried out over 11 days from February 24 to March 6, 2025. That sequence highlights the operational pressure involved in containing losses while preparing assets for disposal.
According to the Gwangju office and local media reports, the Bitcoin was moved illicitly after officials were deceived through a phishing site. Investigators then traced the destination wallet and worked with domestic and international exchanges to freeze transactions tied to the stolen funds. Once known liquidation paths were blocked, the hacker returned the assets, allowing full recovery within three days of formal notification.
From an operational and product-design perspective, the incident exposed specific failures at the point where people and systems interact. Social-engineering tactics bypassed expected custody protections, while weak permission transparency and delayed anomaly alerts increased exposure during the transition from seizure to storage. In effect, the assets remained vulnerable even while under state control.
Why the sale was handled in stages
After recovering the Bitcoin, prosecutors chose not to sell it all at once. The 11-day liquidation was carried out in smaller increments to reduce slippage and avoid unnecessary disruption to the market. Exchange coordination remained central throughout the process, not only during recovery but also in preserving the value of the assets as they were converted into fiat.
Authorities identified the destination wallet through forensic work, froze liquidation channels with exchange support, secured the return of the funds once those channels were blocked, and then executed a gradual sale to manage market impact. That approach closely reflects the discipline required in high-value asset disposition.
Firms need to reduce the chance of credential or seed-phrase deception through clearer confirmation flows, stronger permission visibility, and multi-party signing, while also maintaining fast information-sharing channels with exchanges to preserve recoverability.
The outcome was a relatively orderly conversion of volatile digital assets into a fixed fiscal result. The practical lesson is that better alerting, simpler approval flows, and auditable handoff permissions can reduce the operational and UX risks that continue to shape custody failures.
