Oxford kidnapping took over $2M in crypto, victim says

By Daniel Okafor

Five masked men kidnapped and assaulted crypto investor Evan Luthra in Oxford, England, on November 4, 2025, forcing him to unlock his phone and taking more than $2 million in digital assets in about 30 minutes, according to Luthra’s account. Thames Valley Police confirmed the incident and opened an investigation that included financial tracing and a review of CCTV footage.

How did the Oxford attack unfold?

Luthra, a Forbes 30 Under 30 honoree, said he had attended an event at Oxford University and was with four friends when five masked assailants ambushed the group. The attackers assaulted him and forced him to unlock his phone using Face ID.

Once inside, the kidnappers moved more than $1.5 million from his Binance account and approximately $600,000 in Ethereum (ETH) from Gate.io. They also took a Richard Mille watch valued at around £450,000.

The split placed the recovery process across two centralized platforms, making each exchange’s ability to identify and freeze the relevant balances central to the effort.

Luthra said “delays in getting access to his phone,” which he attributes to police procedures, made the situation worse and “significantly affected how much he ultimately lost.” His public profile has also been cited as a potential factor in why he was targeted.

How much of the stolen assets was recovered?

Just under $1 million in assets has been recovered with help from exchanges and a UK court order issued under the Proceeds of Crime Act (POCA), Luthra said. Binance’s share of the recovery came to about $370,000.

That contribution illustrates how centralized platforms can sometimes freeze or claw back funds when they work with law enforcement and courts. It also shows the limits of that response: the gap between more than $2 million taken and just under $1 million recovered represents value that can slip away before anyone acts.

For other victims, the case supplies a working precedent: existing UK proceeds-of-crime tools can apply to digital assets held on exchanges, which may offer a clearer path to recovering at least part of a stolen haul.

What happens in court?

Proceedings are underway against one suspect, Abdul Malik Cali, 24, who faces five counts of conspiracy to commit robbery. The trial was initially scheduled for November 2026 and has since been postponed until November 2027, extending the wait for a courtroom reckoning to more than two years after the attack.

Luthra’s identity as the victim was not public at first. He disclosed the kidnapping and partial recovery months later, in a November 2026 interview, after investigators opened the inquiry into the November 4, 2025 attack.

What does the case show about “wrench attacks”?

The case arrives amid a reported global increase in so-called wrench attacks, in which criminals use physical coercion to obtain access instead of bypassing security through software. Luthra’s account fits that pattern: a forced Face ID unlock gave the attackers control of phone-based access to exchange balances.

That sequence matters operationally because account security did not stop the extraction once attackers compelled the holder to authenticate. The loss also extended beyond crypto to a physical asset, while the delayed phone access, according to Luthra, increased the damage.

The next fixed legal date is November 2027, when the trial against Cali is scheduled to proceed, while any further recovery will depend on exchanges and UK courts acting quickly under existing POCA powers.