Mentioned in This Article
1. What happened in the Oxford crypto kidnapping?
In what is being described as a crypto kidnapping, investor Evan Luthra says five masked men attacked him and took more than $2 million in digital assets in Oxford, England. In a November 2026 interview, he described an assault that lasted about 30 minutes and dated to November 4, 2025. Luthra says just under $1 million has since been recovered, and one suspect is charged, with a trial now pushed back to November 2027.
Luthra, a Forbes 30 Under 30 honoree, was not publicly named as the victim when the robbery first became known. His identity emerged only months later, when he spoke openly about what he had gone through and about the partial recovery of his funds.
The account is his own, and several of its elements, including his criticism of police handling, reflect his perspective and have not been independently established.
2. How did the robbery unfold?
According to Luthra, he had just left an event at Oxford University and was with four friends when five masked assailants ambushed the group. He says he was assaulted and forced to unlock his phone using Face ID, after which the attackers worked through the device quickly.
Luthra says the haul included more than $1.5 million taken from an account at Binance and roughly $600,000 in Ethereum (ETH) withdrawn from Gate.io. The group also took a Richard Mille watch valued at around £450,000. It is not stated whether the watch was ever recovered.
Thames Valley Police have confirmed the incident and opened an investigation. The inquiry includes tracing the movement of the stolen funds and reviewing CCTV footage.
Biometric unlocking is the detail that stands out. A phone that opens with a face scan can be forced open by an attacker who physically controls the victim, and once the handset is open, banking and exchange apps that rely on the same device become accessible within minutes.
3. How much money has been recovered?
Luthra says nearly $1 million has come back with the help of exchanges and a UK court order issued under the Proceeds of Crime Act, known as POCA. Of that, he says about $370,000 was returned through Binance.
The gap between the more than $2 million taken and the just under $1 million returned illustrates how much can be lost before any freeze takes effect. Stolen cryptocurrency can be moved across wallets and platforms in minutes, so the first hours after a theft are usually decisive for whether investigators can intercept it.
The recovery nonetheless shows that routes exist. Exchanges that hold customer funds can restrict accounts when presented with a credible request or court order, and the Proceeds of Crime Act gives UK authorities and courts tools to deal with assets linked to criminal conduct. That the order was applied to digital assets held on exchanges may offer a clearer path for future victims who seek to recover at least part of what they lost.
4. Why does Luthra blame police procedures?
Luthra says delays in obtaining access to his phone made matters worse. He argues that the time lost significantly affected how much he ultimately lost, since the speed of any response matters greatly when funds can be moved quickly.
This is a claim about process, and it should be read as his account. The article that carried his comments presents it as his view and does not set out a response from the police on that specific point.
Luthra has also suggested that his public profile may have been a factor in why he was targeted. Criminals who select victims by visible wealth or online prominence often rely on social media posts, event appearances and press coverage to find them, which is a recognized risk for anyone who is open about holding digital assets.
5. What charges does the suspect face?
One suspect, 24-year-old Abdul Malik Cali, faces five counts of conspiracy to commit robbery. Police reporting from last year described him being arrested and remanded, with other people also arrested and released on bail while inquiries continued.
The trial was originally scheduled for November 2026 and has been postponed to November 2027. That leaves more than two years between the attack and the proceedings. Such gaps are common in complex multi-defendant cases.
Under the English justice system, a defendant is presumed innocent until a court decides otherwise, and a conspiracy charge does not mean that anyone has been convicted. Whatever the court decides next year will determine the outcome of the criminal case, separate from the question of financial recovery.
6. How does a Proceeds of Crime Act order help victims?
The Proceeds of Crime Act is the main UK law used to confiscate, freeze and recover assets connected to criminal activity. Courts can issue orders that restrain property or direct that it be handled in a specified way, and those orders can be served on financial institutions, including cryptocurrency exchanges that operate in or serve the UK.
In practice, an order gives an exchange a legal basis to hold or release funds that it might otherwise be reluctant to touch. Platforms normally act on customer accounts only when required, because freezing a legitimate user's balance without authority exposes them to complaints and legal claims. A court order removes that uncertainty and allows the exchange to cooperate with investigators and return funds to a victim.
The route has limits. It works best when stolen assets are still sitting on a regulated platform that responds to UK legal process. Once funds are routed through mixers, private wallets or offshore services that ignore such orders, recovery becomes far harder, which may explain why roughly half of the stolen value was recovered here and not all of it.
7. Why are physical threats a growing concern for crypto investors?
As digital assets have become more valuable, the personal safety of well-known holders has become a security topic in its own right. Public conference appearances, social media posts about gains and publicized wealth can all help criminals identify a target and the times when that person is away from home or in a vulnerable position.
Security advisers often recommend treating physical safety as part of an overall plan. That can include avoiding disclosure of the size of holdings, varying routines, and arranging accounts so that no single device or login can move a large sum on its own. Some platforms offer features such as time-locked withdrawals, which delay large transfers and give a victim or an exchange time to intervene.
The Luthra case adds to a body of reported incidents in which attackers focused on the victim and not the technology. It also shows how a phone that holds app logins and biometric access can become the single point of failure for an entire portfolio.
8. What are wrench attacks on crypto holders?
The case comes amid a reported surge in so-called wrench attacks against crypto investors worldwide. The phrase describes criminals who skip hacking altogether and use physical force or threats to make a victim hand over access to digital assets.
The name draws on a long-standing security joke: the strongest encryption can be defeated by a person with a wrench who simply forces the owner to reveal the key. Bitcoin and other tokens are bearer-style assets, meaning whoever controls the keys or the logged-in device controls the funds, and transfers are generally irreversible once confirmed.
That combination is attractive to criminals. A bank transfer can often be reversed or frozen, whereas a blockchain transaction cannot be recalled. The incentive to coerce the owner is therefore higher than for traditional assets, particularly when the target is known to hold large sums.
9. What does the case mean for holders and exchanges?
The case underlines the role that exchanges play after a theft. Binance's return of roughly $370,000 shows that centralized platforms can sometimes freeze or claw back funds when they cooperate with law enforcement and courts, an option that does not exist for assets already moved to private wallets.
For individual holders, the episode points to practical precautions that security specialists commonly recommend. These include limiting how much sits in accounts reachable from a single phone, using withdrawal delays and address allow-lists, and keeping the public profile of one's holdings low. Splitting funds between a hardware wallet and exchange accounts also means that one forced unlock does not expose everything.
Exchanges face their own questions. Faster verification of victim reports, clearer emergency contact channels and tools for temporary account locks could shorten the window in which stolen funds can be moved out.
10. What happens next in the case?
The next major milestone is the trial of Abdul Malik Cali, now set for November 2027. Until then, the Thames Valley Police inquiry into the wider group, the tracing of funds and any further asset recovery under the court order remain the key open items.
For Luthra, the unresolved questions are how much of the remaining losses can be recovered and whether his criticism of the investigation prompts any change in how such cases are handled. For the wider market, the case adds to the evidence that physical security is now part of crypto risk management.
Readers following the case should note the limits of what is known. The attack date, the charges against Cali and the postponed trial date are matters of record in the reporting, while the total lost, the amounts recovered and the criticism of the police response come from Luthra's own account. Further detail may emerge as the investigation and court process move forward.