1. What happened in the London crypto theft
This London crypto theft cost a former crypto executive roughly $14,000 in digital assets, card charges and trading costs after thieves seized his unlocked iPhone in east London shortly after 1 a.m. on August 8. Within hours, the men who took the device had reached his crypto wallets, financial accounts and personal data. The victim, Magnus Ahmad, now runs an AI education business and has spent about fifteen years in the crypto industry, which makes his experience a pointed example of how a single street theft can become a financial crime.
Ahmad had just arrived in London and was out with old friends when the incident began. Two men approached him outside a bar in Hackney. They reappeared near The Dolphin pub on Mare Street after his friends had gone inside, and one of them offered to help him enter a phone number. Ahmad handed over his unlocked iPhone 14 Pro Max. A third man then grabbed it and ran off into the night.
The case is useful because it traces a complete chain of events with timestamps. The theft itself took seconds, yet the financial consequences unfolded over several hours, touching services that most people use daily without thinking of them as a single point of failure. For anyone who keeps crypto on a mobile device, the sequence is a practical illustration of what an attacker can do with physical access to an unlocked handset.
2. How the thieves got the phone
The approach relied on friendliness rather than force. Ahmad recalls that he was typing in the stranger's number when the man told him to let him do it instead because it would be quicker. That small, plausible request was enough to put an unlocked device in the hands of someone he had never met. The detail matters because an unlocked phone bypasses the passcode and biometric checks that normally stand between a thief and the apps stored on it.
Once the third man had the phone, Ahmad reacted instinctively. He chased the thief through quiet streets for several hundred feet, but despite being a competitive racket sports player he could not catch him. He then returned to the bar and asked staff to call the police. At that point he did not realise how quickly his accounts would be targeted, and the minutes he spent chasing the runner and speaking with others would later look like lost time.
3. How fast were the accounts emptied?
The accounts were attacked almost at once. By 1:53 a.m., cryptocurrency was already being converted and transferred out of Ahmad's MetaMask wallet, and his Phantom and Bybit accounts had also been accessed. By 3:22 a.m., six unauthorized card transactions had gone through, including more than $2,000 spent at Costcutter, a convenience-store chain. The thieves also booked an Uber ride using his accounts.
They did not stop at wallets and cards. The intruders reached his eToro account and opened leveraged crypto positions carrying close to $44,000 in trading exposure. That figure describes the size of the positions, not money withdrawn from his account. What Ahmad actually lost on those trades was a much smaller sum in losses and costs, which is why exposure and realised loss need to be kept apart when reading the total.
Ahmad puts his overall loss at about $14,000. Roughly $9,500 of that was cryptocurrency, nearly $3,000 was card charges, and a little over $800 came from the eToro losses and costs. The speed and breadth of the activity, covering self-custody wallets, an exchange account, a trading platform, payment cards and a ride-hailing app, shows how many financial services can sit behind one phone.
Mobile wallets such as MetaMask and Phantom are designed for convenience, and an exchange app such as Bybit offers one-tap access to funds. When those applications are open or easily unlocked on a device that has been handed over, the usual protections matter less than the state the phone was in at the moment of the theft. That is why security specialists stress locking devices quickly and limiting what any one phone can reach.
4. What stayed safe, and what broke
The damage could have been larger. Ahmad's bigger bank balances and his other crypto holdings remained intact after he froze his cards and regained control of the key accounts. He noted that his life savings were also reachable through the apps on that phone, and the thieves were not able to withdraw them. Acting on the cards and the main accounts was what limited the losses.
Recovery was slow and stressful. Over the following seven hours he worked to take back his accounts. His MacBook also became unusable, and he suspects the thieves locked it remotely through his Apple account. That cause has not been independently established, so it remains his belief rather than a confirmed fact. The episode shows how accounts tied to one ecosystem can fall together when one device is compromised.
The frozen cards and the intact savings also show the value of speed. Every minute between a theft and the first lock-down is a minute in which an attacker can change passwords, approve transfers or open new positions. Ahmad's seven-hour effort to reclaim his accounts underlines that recovery tends to take far longer than the attack that caused the damage in the first place.
5. A familiar problem on London's streets
Ahmad's case fits a wider pattern. An unlocked phone exposes banking apps, crypto wallets, trading accounts and email, so a thief who obtains one in that state can move quickly from the handset to the money. The method he describes, in which thieves befriend a victim and persuade them to hand over an unlocked phone, resembles cases examined in an investigation published in August.
London is also a major source of stolen phones that are shipped abroad. One report tied a single gang to 40,000 stolen iPhones, and some victims have had their phones traced overseas. Stolen iPhones have been located in China through Apple's Find My service. The Metropolitan Police dismantled a group suspected of trafficking up to 40,000 stolen phones to China, and three men were sentenced to a combined 25 years in prison.
Police data suggest the situation has been improving. Metropolitan Police figures cited in July showed that phone thefts in the West End fell 50% over the previous year. Those numbers describe a broader area, however, and they do not establish what happened specifically around The Dolphin or on Mare Street in Hackney.
6. What does the pub manager say?
The Dolphin's manager, Lord Cemal, says phone theft around the pub was a serious issue. His own daughter was a victim: her iPhone was stolen and then activated in China two weeks later. He believes conditions have improved since Ahmad spoke to police and since he reported a group operating near the pub. According to Cemal, police detained three people suspected of using a similar method.
That account could not be independently confirmed, and it has not been linked to Ahmad's case. The Metropolitan Police did not respond to requests for comment about his experience. In a statement on October 8, the force acknowledged that criminals are using increasingly sophisticated methods against mobile devices. In a separate October statement, police commander Andy Featherstone said phones are more than devices for making calls or going online.
7. What should a victim do first?
Ahmad's main lesson is that he should have secured his accounts immediately instead of chasing the thief. Pursuing the suspect and speaking with police first gave the criminals time to move funds and change account access. His advice to others is blunt: do not chase the runner or the cyclist. Instead, use another device to sign in to the Apple or Google account and secure the stolen phone remotely, ideally before calling police and, if necessary, from a friend's phone.
Remote locking and marking a device as lost are useful steps, but they do not guarantee that the phone becomes unusable or that stolen funds can be recovered. Victims should also contact their banks and mobile carriers, and a police report remains important when seeking reimbursement from financial institutions. Freezing cards quickly, as Ahmad did, can protect the balances that thieves have not yet reached.
He has changed his own habits. When he goes out, he now carries an older iPhone with a separate Apple account and only a few apps installed, so that a theft exposes far less. The practice reduces the amount of financial access that any single handset carries.
A sensible order of response follows from his account: first secure the Apple or Google account from another device, then freeze cards and contact the carrier, then secure exchange and wallet access, and only then deal with the police report. Preparing in advance helps as well, for example by knowing which devices are signed in to which accounts and by keeping the number of financial apps on a phone to the minimum needed.
8. What are the lasting risks?
The financial loss is only part of the problem. Ahmad's phone held photos of his identity documents and those of people close to him, and he is concerned about future identity fraud. Stolen identity data does not expire when accounts are frozen, so the risk can continue long after the immediate losses are counted.
He hopes the account will serve as a public service announcement, especially for crypto users, because the crypto accounts were the most vulnerable on his device. Digital asset transfers are fast and are generally irreversible, which leaves little room for recovery once the funds have moved. His closing point is that people ignore the danger because no one thinks it is going to happen to them.