A stolen, unlocked iPhone was all it took to drain several crypto wallets and trading accounts within hours in east London. The case, reported by CoinDesk and analysed by security firm OneSafe, underlines a basic reality: a stolen phone is first and foremost a key to the funds it can reach. Timeline, losses and protective measures are detailed below.
🔑 Key takeaways
- An unlocked iPhone 14 Pro Max, handed to a stranger, served as the entry point for the attack that took place on August 8, 2026 in Hackney.
- The victim estimates total losses at about $14,000, including about $9,500 in cryptocurrency.
- His largest bank balances and other crypto holdings reportedly remained intact after he froze his cards.
- Remote lock, session revocation and dropping SMS as a sole second factor are the top priorities.
- Several points in the timeline remain contested or unverified by independent sources.
One evening, one phone, an attack in several stages
On August 8, 2026, shortly after 1 a.m., Magnus Ahmad was in Hackney, in east London. A former crypto executive who now runs an AI training business, he says he has 15 years of experience in the industry. He had just arrived in the capital and was out with old friends outside the Market Hall when he handed his iPhone 14 Pro Max, already unlocked, to a stranger he believed was simply typing in his phone number. Seconds later, a third man snatched the device and ran.
The approach had begun much earlier. Two men had first engaged Ahmad at the Market Hall. After spending several hours with him, posing as regulars having a drink, they repeatedly looked over his shoulder. Ahmad entered his passcode several times in front of them. When his friends went inside, the two men reappeared outside The Dolphin on Mare Street.
Ahmad describes the final moment as a remarkably simple manipulation. He told CoinDesk:
“I was typing in his number and he said, Oh, let me do it, it will be quicker.”
Magnus Ahmad, former crypto executive
The phone then passed to a third man, who ran off. Ahmad chased him for several hundred feet through quiet east London streets, shouting, but failed to catch him despite his competitive background in racket sports. He went back to the bar and asked staff to call the police, not knowing that his accounts were about to be targeted almost immediately.
A timeline that accelerates
According to Ahmad’s account, access to his accounts came in quick succession over less than two hours, spanning cryptocurrency, bank cards, a ride-hailing service and a trading platform. The times below come from his testimony and have not been reconstructed by an independent source.
- At 1:53 a.m., cryptocurrency was converted and transferred out of his MetaMask wallet. His Phantom and Bybit accounts were also accessed.
- By 3:22 a.m., six unauthorised card transactions had been completed, including more than $2,000 of purchases at the convenience chain Costcutter.
- The thieves used his Uber account to book a ride.
- They accessed his eToro trading account and opened leveraged positions representing nearly $44,000 of exposure.
Leveraged positions, not a withdrawal
The $44,000 figure reflects the exposure of open positions, not a withdrawal. Those positions generated losses and additional fees, totalling more than $800 according to Ahmad. Leverage amplifies both gains and losses, so a small price move can inflict damage far out of proportion to the margin posted. This distinction matters for anyone trying to gauge the real scale of the theft.
Loss breakdown and protective measures
Ahmad puts the total at roughly $14,000. The table below breaks down the items as he reported them.
| Item | Estimated amount |
|---|---|
| Cryptocurrency converted and transferred | about $9,500 |
| Unauthorised card spending | almost $3,000 |
| eToro losses and fees | more than $800 |
| Total estimated by the victim | about $14,000 |
One detail stands out: his largest bank balances and other cryptocurrency reportedly stayed intact after he froze his cards and regained control of key accounts. He then spent seven hours straight trying to recover his access. His MacBook became unusable, and he suspects the thieves locked it remotely through his Apple account, a cause that has not been independently established. The phone also held photos of his identity documents and those of relatives, which raises concerns about identity fraud.
“My savings are also on this phone, in my bank accounts, and they could not take them.”
Magnus Ahmad, former crypto executive
Lessons from the incident
Ahmad draws several recommendations, all placing remote lock ahead of chasing the thief or waiting for police:
- Do not chase the thief. The priority is to secure the phone remotely.
- From another device, sign in immediately to the Apple or Google account to lock the stolen iPhone before thieves reach financial apps or change credentials.
- Contact banks and mobile operators without delay and report the theft, since a police report remains important for refund claims.
- When going out, carry an older iPhone linked to a separate Apple account, with only a handful of apps.
Ahmad believes he would have limited the damage by working from a friend’s phone instead of waiting for his laptop, and that he should have secured the device before calling the police. These steps can protect accounts, but they guarantee neither that the compromised device becomes unusable nor that funds will be recovered.
“What you do not mind being stolen is obviously the best defence.”
Magnus Ahmad, former crypto executive
OneSafe’s reading: an access-control failure
OneSafe characterises the incident as an access-control failure rather than a failure primarily attributable to police: the stolen device became a key to the funds. An unlocked phone holding an active session, an email account, an authenticator app or SMS messages can provide enough to authorise transfers. Recovery phrases or private keys stored in notes, photos or cloud storage raise the risk further. Relying on SMS as the only second factor is also considered risky, particularly in the event of a SIM swap.
For individuals, OneSafe recommends locking and disabling the device, revoking sessions, changing passwords, invalidating API keys, suspending permissions, requesting an account freeze, reviewing transactions and documenting the incident. On the platform side, it cites multi-factor authentication, hardware security keys, remote revocation, withdrawal address allowlists, withdrawal delays, approval thresholds, alerts, institutional custody, and the absence of SMS-only authentication for significant transfers.
- For companies: app-level passcode or biometrics, no recovery phrases in phone notes or photos, and an authenticator or hardware key with a separate fallback path.
- SIM protection, a device inventory, and session revocation when staff leave.
- Regular testing of the incident response procedure.
A wider London problem, and points still to verify
The case fits a broader pattern. A Times investigation published in August described a similar method: thieves first befriend victims, persuade them to hand over an unlocked phone, then access their crypto accounts. London has also become a significant source of stolen iPhones shipped abroad. The BBC investigated this international trade, one report linked a gang to 40,000 stolen iPhones, and Metro documented devices recovered in China through Apple’s Find My service.
The Metropolitan Police dismantled a group suspected of moving up to 40,000 phones to China, and three men were sentenced to a combined 25 years in prison. In a statement dated October 8, police warned that criminals are using increasingly sophisticated methods to steal and exploit mobile devices. Commissioner Andy Featherstone summed up the stakes: phones hold precious photos, store our financial information and give access to large amounts of personal data.
Lord Cemal, manager of The Dolphin, acknowledged that phone thefts around the venue had become a serious problem, with his own daughter a victim: her iPhone was activated in China two weeks later. He nonetheless considers the situation to have calmed, and says police detained three people suspected of using a similar method. Metropolitan figures reported by The Times in July also showed a 50% year-on-year drop in phone thefts in the West End, though they do not establish precisely what happened around The Dolphin.
What the sources cannot confirm
Several elements remain fragile. CoinDesk could not confirm the arrests Lord Cemal described or any link to the Ahmad case, and the Metropolitan Police did not respond to requests for comment. OneSafe says the report does not specify the phone’s lock status or the wallet provider, which does not match the initial account describing an unlocked iPhone and naming MetaMask, Phantom and Bybit. The same source also does not state that the account was a business one.
Publication dates also diverge. OneSafe and Blockdeck give October 31, 2026, with Blockdeck timestamped 16:09 UTC, while the CoinDesk URL carries the date November 1, 2026. Ground.news provides only a summary of the same article, with no additional facts. Finally, Blockdeck shows two contradictory market readings on the same page: its summary cites bitcoin down 0.1% in the first hour, while its table shows +0.12% over the same period and +0.39% since publication, at a price of $77,622.68. The page states its prices are live rather than those at publication time. No other market reaction directly tied to the affair is documented in the sources provided.
Outlook and scenarios
The case shifts the debate: the risk to digital assets lies less in cryptography than in access points, namely the phone, the active session and account recovery. Three scenarios stand out. In the first, wider adoption of hardware keys and biometrics sharply reduces successful thefts, at the cost of more friction for users. In the second, criminal pressure persists on consumer mobile devices, and platforms tighten withdrawal delays and address allowlists. In the third, cross-border investigations into the trade in stolen iPhones lead to more convictions without an immediate effect on individual risk.
For now, no lasting price move can be attributed to this incident. The operational message is unchanged: secure the phone first, separate usage, and never keep recovery phrases on a connected device.
Sources
- CoinDesk, article of November 1, 2026
- OneSafe, incident analysis, October 31, 2026
- Ground.news, summary of the CoinDesk article
- Cryptonews, incident coverage
- Blockdeck, news item of October 31, 2026
- Outposts.io, republication of the CoinDesk article
Cet article est publié à titre informatif et éducatif. Il ne constitue en aucun cas un conseil en investissement. Faites vos propres recherches (DYOR) avant toute décision.
