The victim had spent years in the industry. The attackers needed a couple of hours in a bar, a borrowed phone and a passcode they had watched him type.
LONDON โ A former cryptocurrency executive lost roughly $14,000 in digital assets, plus more than $2,000 in card spending and a further $800 or so in a leveraged trading account, after his unlocked iPhone was grabbed out of his hand in a bar in Hackney, according to an account he gave to CoinDesk. The case has travelled widely through crypto media in the weeks since, and it has done so for an uncomfortable reason: nothing was hacked. There was no smart contract exploit, no exchange intrusion, no cryptographic break. What there was, was a six-digit passcode observed over a drink, and one decision to hand an unlocked handset to a stranger.
The Two-Hour Window
The timeline, as reconstructed from the victim's account, runs from roughly 1:00 a.m. to 3:22 a.m. In that span, a phone was taken, two self-custody wallets were accessed, an exchange account was opened, six card transactions were completed at a convenience store, and a leveraged position with a notional value of about $44,000 was established on a trading platform. The entire sequence took under two hours and twenty minutes.
The preparation took longer. According to the account, the attackers spent an extended period in social contact with the victim inside the bar, and during that time observed him entering his device passcode on multiple occasions. That detail matters more than any other in the case. Shoulder surfing requires no tooling, no malware and no particular skill; it requires proximity, patience and a target who is talking, drinking and not shielding a screen.
The pivot came with a request. One of the group asked the victim to help enter a contact into his phone. When the device was handed over, already unlocked, a third accomplice took it and ran. The victim gave chase. That instinct, entirely human, was the single most expensive decision of the night: while he pursued the runner through the street, nobody was remotely locking accounts, freezing cards or moving assets to a safe address.
The window that opened was used methodically. At 1:53 a.m., assets inside a MetaMask wallet were swapped and transferred out. A Phantom wallet was then accessed, and a Bybit account was opened. By 3:22 a.m., six transactions totalling more than $2,000 had been completed on the victim's cards via Apple Pay at a Costcutter convenience store. Separately, an eToro account was used to open a crypto leveraged position with roughly $44,000 in notional exposure, which was closed out at a loss plus fees of a little over $800.
What Was Not Hacked
The most important clarification in the source reporting is also the one most frequently lost in retelling. The account describes unauthorised account activity following a physical theft. It does not establish that any underlying wallet service or trading platform suffered an intrusion. There is no evidence of a compromised smart contract and no evidence that an exchange was breached. Any framing of the incident as "MetaMask hacked" or "Bybit hacked" is a misreading of the facts.
That distinction is not pedantry. It determines where the remediation budget belongs. Protocol-level security is addressed with audits, formal verification, bug bounties and monitoring. Endpoint security is addressed with device discipline, credential separation and account architecture. Confusing the two produces the worst outcome available: users who believe they are protected because the protocol is, and platforms that believe they are exonerated because the code held.
What the code did, in fact, was exactly what it was designed to do. It executed transactions authorised by a device that was unlocked and in the hands of someone who was not the owner.
The Passcode Is the Master Key
The technical core of the case is a co-location failure. A single six-digit passcode served simultaneously as the key to the device, the wallet applications on it, the payment instruments bound to it, the email account that anchored password resets, and the exchange applications that remained logged in. One credential, five trust domains, no separation.
Apple's Stolen Device Protection, introduced with iOS 17.3, is frequently cited as the answer to this class of attack. It is not. The feature protects the Apple ID and device ownership: it blocks passcode-only changes to the Apple ID password and prevents disabling Find My when the device is away from a familiar location, adding a biometric check and a one-hour delay for the most sensitive operations. It does not interpose itself between an unlocked phone and the third-party applications running on it. A MetaMask, Phantom, Bybit or eToro session remains fully exposed the moment the device is unlocked.
The victim was using an iPhone 14 Pro Max, which supports the feature. Whether it was enabled has not been disclosed, and that omission matters: the failure cannot be attributed to an Apple feature that may never have been switched on, nor can the case be used to argue the feature is broken.
The wallet layer presents a similar gap. If a mobile wallet requires a separate passcode or biometric confirmation before signing a transfer, and enforces an address whitelist for withdrawals, unlocking the phone is not sufficient to move funds. The reporting does not describe any such configuration. The speed with which roughly $9,500 in assets left the MetaMask wallet, inside an hour, is consistent with default settings that prioritise low friction. The same logic applies to the seed phrase: for an attacker to restore a wallet on a fresh device, they need the recovery phrase in readable form. The most plausible explanation for the pace of the drain is that recovery material existed on the device or in its cloud backup, in a photo, a note or a keychain entry.
Two-factor authentication offers no rescue when it lives on the same handset as the assets it is meant to protect. The Bybit and eToro accounts were both reached. Either the verification codes arrived on the stolen phone, or the platforms' new-device controls issued warnings without blocking access. Neither possibility is reassuring.
The Identity Overhang
The financial loss is the visible part of the damage and probably not the largest part. The phone reportedly contained photographs of identity documents. Combined with control of the associated email address and phone number, that material is sufficient to attempt account recovery procedures across multiple regulated platforms, and potentially to pass elements of know-your-customer verification in the victim's name.
This is where endpoint compromise becomes a long-tailed liability. Stolen funds are gone and unrecoverable; a stolen identity can be replayed for years. The countermeasures are unglamorous and slow: credit monitoring, fraud alerts, direct notification to exchanges with a request to place a manual hold on the account, and a documented police report to anchor any future dispute.
There is also a compliance dimension that the industry rarely discusses. Exchanges build robust KYC and recovery flows because regulators require them. Those same flows are the mechanism an attacker uses to take over an account when the identity artefacts and the communication channels are all in one place. Strong identity verification and strong account takeover resistance are not the same property, and the case illustrates the gap.
Who Pays
In the United Kingdom, where the incident occurred, unauthorised card transactions benefit from a mature liability regime. The victim's six contactless purchases, all above the typical single-transaction threshold in aggregate, sit within that framework. But the framework has an exception: where the payment institution can demonstrate gross negligence by the cardholder, liability can shift. Whether having a passcode observed and a phone snatched constitutes gross negligence is genuinely arguable, and it is the one part of this case with real legal room to move.
The crypto assets sit in a different universe. There is no deposit insurance, no statutory reimbursement and no chargeback. On-chain transfers are irreversible, and law enforcement recovery rates for this profile of crime are negligible. The source reporting is explicit that protecting the device does not guarantee recovery of funds, which is a polite way of saying that recovery is not a mechanism at all.
The leveraged account raises a third, unresolved question. The victim is a UK resident. Since 2021, the Financial Conduct Authority has prohibited the sale of cryptoasset derivatives to retail clients in the UK. If a UK-resident retail client was able to open a crypto leveraged position with roughly $44,000 in notional exposure, the question of which legal entity held the account, and under which jurisdiction's permissions, is worth asking. The reporting does not identify the entity. It should be treated as an open question rather than an allegation.
What the Industry Should Read Into It
The strategic lesson is not that a phone was stolen. It is that self-custody's security narrative has been built on a claim that is true but incomplete. Holding your own keys does not mean holding exclusive control of them. In practice, control is delegated to a device passcode, and that passcode is the least defended element in the entire stack.
The products that would structurally fix this already exist, and their adoption problem is friction rather than feasibility. Account abstraction, in the ERC-4337 model, converts an account from a single private key into a programmable permission system supporting session keys, spending limits, multi-signature approval and social recovery. Passkeys replace a six-digit secret that can be observed with a biometric check that cannot. Hardware signers remove the signing key from the general-purpose device entirely. None of these would have made the victim's bar tab safer, but any of them would have made the phone grab unprofitable.
The most defensible reading of the incident is that it is an old problem in a new setting, closely analogous to the long record of hardware wallet compromises driven by user error rather than cryptographic failure. The attack cost was one evening of social labour and two or three people's time. The return was roughly $14,000 plus a resaleable high-end handset. The probability of consequence is low. Economics like that do not self-correct when a case is publicised.
Several facts remain undisclosed, and they are the ones that would decide whether this was a cautionary tale about defaults or an industry-level alarm: whether Stolen Device Protection was active, whether the wallets enforced a second biometric confirmation, whether independent 2FA existed, whether recovery phrases were stored digitally, whether exchange applications held persistent sessions. If a seasoned operator with layered defences can still be emptied, the problem is structural. The available evidence points instead to default configurations and a single lapse in the moment, which is both less alarming and more fixable.
What the case does not support is the conclusion most likely to be drawn from it. The protocol was not the weak point. The endpoint was. Those two risks require different budgets, different expertise and different products, and the industry's habit of treating every loss as evidence about blockchain security is precisely the confusion that lets the real gap stay open.