1. Crypto theft plot ends in an eight-year sentence
Scotland's High Court of Justiciary has sentenced Robert Barr, 29, to eight years in prison for organizing, from his own prison cell, a crypto theft plot aimed at taking up to £2 million (about $2.7 million) from a Midlothian home. Two accomplices, Sean Favier, 26, and Iain Doyle, 37, received four and five years. The scheme collapsed when the targeted couple refused to open their door.
All three men pleaded guilty to involvement in serious organised crime. Lord Cubie passed sentence at the High Court in Glasgow, and the details of the case were set out in a sentencing statement published by Scotland's Judicial Office on Tuesday.
The judge summed up the case as a blend of present-day computer know-how and what he called old fashioned housebreaking, with a target of cryptocurrency worth as much as £2 million. The combination is what makes the case stand out: the plan depended both on physical access to a victim's home and on the ability to drain digital assets remotely once that access was secured.
The sentences reflect the different roles the three men played. Barr, as the organizer and the person who would have carried out the transfers, received the longest term. Doyle and Favier, who were sent to the house, received five and four years respectively. Scotland's High Court of Justiciary is the country's supreme criminal court, and it handles the most serious offences, including organised crime cases of this kind.
2. How the remote-access scheme was meant to work
The division of labor was straightforward. Favier and Doyle were to enter the victim's house in Midlothian, the county just south of Edinburgh, and compel him to install AnyDesk, a widely used remote-access program that lets one computer be operated from another over the internet.
Barr would take it from there. At the time he was serving a 21-month sentence at HMP Edinburgh for fraud, yet the plan assigned him the technical role: once AnyDesk was running on the victim's machine, he would take control of it from inside prison and move the cryptocurrency into wallets under his own control.
Remote-access software has many legitimate uses, from IT support to working from home. Its appeal to criminals lies in the same feature that makes it useful: anyone granted access can see the screen, move the mouse and type as if sitting at the keyboard. For a holder who keeps crypto on a computer or in software connected to it, that means a stranger with remote access can approve transfers directly.
3. A doorbell camera stopped the raid
The attempt took place at around 11:30 p.m. on April 17, 2024. Favier and Doyle reached the property, but the couple living there watched them on their doorbell camera and declined to let them in. At one point one of the men leaned toward the lens and asked whether there was a camera there.
Lord Cubie made clear that the outcome owed nothing to any change of heart by the offenders. In his view, the scheme failed only because the victims had the good sense not to open their door to masked men late at night.
The moment illustrates how much the plan depended on getting through the door. Every later step, from installing AnyDesk to moving the funds, required the men to be inside the house with the victim at his computer. Once the couple chose to stay behind a locked door and watch the visitors on a screen, there was no way for the scheme to proceed, and the two men left without reaching their target.
4. Months of planning recovered from Barr's phone
Investigators pieced together the background after seizing Barr's phone in June 2024. The messages on it showed that the preparation had stretched over months. The group had identified the victim as someone who held cryptocurrency, gathered pictures of the house and carried out reconnaissance of the property.
The judge found that the messages plainly contemplated threats or violence. That finding was significant because it showed the plan was not simply a burglary. The point of getting inside was to put the victim under enough pressure that he would hand over control of his computer.
5. The victim and an earlier break-in
The intended target was a co-founder of a crypto startup. He did not advertise how much he held, but the accounts he followed online were mostly related to crypto, a detail that hints at how even a low public profile can leave clues for someone looking for a target.
The April attempt was not the first time the house had been hit. In January 2024, associates of the group burgled the property and took a crypto wallet. They were unable to get at the funds, however, because the wallet was protected by a PIN they did not have.
That earlier failure helps explain the shape of the second plan. A hardware wallet or PIN-protected device is of little value to a thief without the code that unlocks it. Forcing the owner to grant remote access to a working computer was a way around that obstacle, because it would put the owner's own credentials and approvals in the service of the theft.
6. Why the court treated Barr's role as aggravated
Prosecutors described Barr as a sophisticated cybercriminal. He already had a conviction for a crypto-related fraud, and he organized this offence while in custody, using illicit means of communication to stay in contact with the men on the outside.
Lord Cubie treated both points as materially aggravating factors. A prior conviction for similar conduct and the decision to run a serious crime while already serving a sentence both weigh heavily in sentencing, and they help account for the gap between Barr's eight years and the shorter terms handed to Favier and Doyle.
The case also raises questions about how a prisoner was able to coordinate a months-long scheme from inside HMP Edinburgh. The court heard that he did so through illicit contact, a reminder of the persistent problem of unauthorized phones and communication channels in prisons.
Barr's earlier fraud conviction was the reason he was in HMP Edinburgh in the first place. Rather than ending his involvement in crypto crime, that sentence became the setting for a far more ambitious scheme, one that relied on others to take the physical risks while he planned to handle the digital side from his cell.
7. What is a wrench attack?
A wrench attack is a robbery in which criminals use physical force or the threat of it to make someone hand over their cryptocurrency. The name comes from the idea that no amount of encryption protects a holder who is being threatened in person. Had Favier and Doyle got through the door in Midlothian, the plot would most likely have turned into exactly that kind of attack.
Such attacks are rising. Blockchain analytics firm Chainalysis has reported that more than $30 million was stolen this way in the first half of 2026, putting the year on track to set a record for this kind of crime.
Part of the reason is the nature of crypto itself. Transfers are fast and difficult to reverse, and a holder who controls their own keys can move large sums without a bank's fraud checks standing in the way. That independence is a core attraction of self-custody, but it also means that once a victim has been coerced into approving a transaction, there is often no institution that can halt it.
8. A string of similar cases in the UK
The Barr case joins a growing list of British prosecutions involving physical attacks on crypto holders. Earlier this year, three teenagers were jailed for stealing $4.3 million in crypto at knifepoint. Last month, three men were sentenced over a failed home invasion that also targeted crypto.
In September, Crimestoppers offered a reward of up to £10,000 for information about an attack on a UK couple. Police believe a fourth man gave the attackers instructions over a video call, a setup that echoes the Barr plan's split between the people at the door and a remote operator directing events.
9. Lessons for crypto holders
The Midlothian couple's refusal to open the door is the simplest lesson of the case. A doorbell camera gave them a look at who was outside before deciding whether to engage, and that was enough to stop a plot that had been months in the making.
The details also underline the value of keeping holdings private. The victim had not publicized his wealth, yet his online activity was enough to mark him as a likely holder. Combined with the earlier theft of a PIN-protected wallet, the case shows how criminals adapt their methods when one layer of protection holds firm.
Security specialists generally advise holders against keeping large balances on devices that can be operated remotely, and against installing any software at the request of someone they do not know and trust. The Barr plan would have turned an ordinary support tool into a theft tool, which is a reminder that the most dangerous moment is often the one in which a holder is pressured into granting access, rather than any flaw in the underlying cryptography.
10. What happens next for Robert Barr
The court will consider a serious crime prevention order against Barr on November 17. Such orders can place restrictions on a convicted person's activities after release, designed to make it harder for them to return to the same kind of offending.
Barr remains in custody and may face extradition. For now, the eight-year term caps a case in which a prisoner tried to turn a remote-access tool and two accomplices into a route to someone else's crypto, and was undone by a camera on a front door.