Ahmad pursued the thief before returning to the bar and contacting police. During the following hours, unauthorized transactions appeared across his cryptocurrency wallets, banking services and eToro trading account.
How Did Thieves Access Multiple Financial Accounts?
The first identified cryptocurrency transfers occurred at approximately 1:53 a.m., when assets in Ahmad’s MetaMask wallet began being converted and transferred. His Phantom wallet and Bybit account were also accessed.
By 3:22 a.m., six unauthorized card transactions had been completed, including more than $2,000 in purchases at Costcutter convenience stores, according to Ahmad’s account.
The reported losses included approximately $9,500 in cryptocurrency, nearly $3,000 in unauthorized card charges and more than $800 in trading losses and associated costs.
The precise method used to enter each account has not been independently established. The phone was already unlocked when it was stolen, potentially exposing active application sessions and account recovery functions. There is no confirmed evidence that the attackers obtained Ahmad’s wallet recovery phrases or exploited vulnerabilities in the affected platforms.
The incident differs from the $282 million Bitcoin and Litecoin theft involving fraudulent wallet support, where the victim was reportedly deceived into disclosing a hardware wallet recovery phrase. In Ahmad’s case, the immediate security breach began with physical possession of an unlocked device.
Investor Takeaway
An unlocked smartphone can expose several financial accounts simultaneously, making device access a critical security risk for cryptocurrency holders.
Why Did Thieves Open $44,000 in Leveraged Crypto Positions?
Alongside the cryptocurrency transfers and card charges, the attackers entered Ahmad’s eToro trading account and opened leveraged cryptocurrency positions representing almost $44,000 in trading exposure.
That figure represents the notional value of the positions, not an amount withdrawn from the account. The unauthorized trading generated losses and costs exceeding $800, according to Ahmad.
The distinction illustrates a separate financial risk. An attacker who gains access to a trading account may be able to cause losses by executing transactions without transferring money elsewhere.
Unauthorized trading has also emerged in other security incidents. AvaTrade Japan recently confirmed that attackers accessed customer accounts and executed unauthorized trades following security incidents involving external service providers. That case involved a different reported access route.
Ahmad said his larger bank balances and other cryptocurrency holdings remained intact after he froze payment cards and regained control of important accounts. He also reported that his MacBook became unusable during the recovery process, although his suspicion that the thieves remotely locked it through his Apple account has not been independently verified.
How Widespread Is London’s Phone-Theft Problem?
The case occurred against the backdrop of organized mobile-phone theft in London, where stolen devices can be sold or exploited for the financial information they contain.
On September 25, the Metropolitan Police announced that three men had received combined prison sentences of 25 years for their involvement in a network responsible for trafficking as many as 40,000 stolen phones from the UK to China during 2024 and 2025.
Police estimated that the operation handled approximately 40% of phones stolen in London during that period.
A separate police update on October 8 reported more than 700 arrests during September as part of a crackdown on phone theft, robbery and handling stolen devices. The Metropolitan Police also reported declining theft figures, although those statistics do not establish whether incidents around The Dolphin have followed the same pattern.
The bar’s manager, Lord Cemal, said phone thefts had previously become a serious local problem but appeared to have declined following police activity. He also reported several arrests involving suspects who allegedly used similar methods. Those arrests have not been independently linked to Ahmad’s theft.
Investor Takeaway
Physical phone theft adds another route to financial account compromise, alongside phishing, credential theft and malware attacks.
What Should Crypto Holders Do After a Phone Is Stolen?
Ahmad said he spent approximately seven hours trying to regain control of his accounts. He now travels with an older iPhone connected to a separate Apple account and containing fewer applications.
His main recommendation is to prioritize securing accounts rather than physically pursuing a thief, which could create additional personal danger.
Apple’s Lost Mode allows users to remotely lock a missing iPhone through Find My. However, remote protection depends on the device’s connectivity and previously enabled security settings. It cannot guarantee that transactions already completed will be reversed.
Police guidance recommends immediately contacting financial institutions, changing compromised credentials, signing out of active sessions and notifying the mobile network provider. Victims should also report the theft and document unauthorized transactions.
The incident adds another dimension to existing concerns about endpoint attacks targeting crypto wallets. Whereas malware campaigns seek access through compromised software or external devices, Ahmad’s reported losses followed the theft of a phone that was already unlocked.
Ahmad also disclosed that photographs of identity documents belonging to him and people close to him were stored on the stolen device, creating an additional potential identity-fraud exposure.
Although he recovered control of his main financial accounts, the estimated $14,000 loss demonstrates how quickly a street theft can become a multi-account financial incident. Whether any of the money will ultimately be recovered remains unresolved.
