Christian d’Ippolito was near Old Street roundabout in the early morning, heading home after a night out. D’Ippolito, 42, sees himself as “pretty street-smart”. He has worked with disaffected young people and given workshops in prisons.
So he didn’t feel threatened when four men started to talk to him. Then one grabbed his iPhone from his hand. After a chase, the thieves fled in a car.
As the car disappeared, d’Ippolito accepted that he’d lost his iPhone. But his plight was actually much worse: he was about to lose his life savings. Over the next few hours, he says, his crypto wallet was emptied of nearly £40,000 worth of assets.
In the six weeks since the theft, d’Ippolito has been thrown off balance. The loss has felt “completely out of my control”. He has been questioning what he has achieved in his career and unsure if he can continue his charity work.
This isn’t one case. London’s Metropolitan Police is dealing with a surge in crypto robberies. Our relationship with our phones has made new crimes possible. And the nature of crypto — irreversible transactions, mediated by new financial players — means that tracking the thieves seems beyond the capacity of law enforcement.
Once, losing a smartphone was horrible because you lost irreplaceable photos. Our photos now tend to be saved on the cloud. The problem is all the information on the device. An unlocked phone is a gold mine for thieves.
If someone has access to your phone, they can read your emails and texts; they may be able to reset passwords and sail through two-factor authentication. If they’ve watched you unlock the phone, they may already know your codes. They probably have a copy of your passport — saved in your photos app — and so could handle most security questionnaires. We walk around with almost all of our most sensitive information, all of the time.
Then there’s crypto. Its popularity and worth have surged. Part of its promise is freedom from traditional guardrails — the opportunity to “be your own bank”.
The most dramatic crypto thefts are kidnappings — where ransoms are demanded, or victims are forced to transfer tokens. In France, thieves have taken several high-profile crypto holders hostage. In January, they cut off one victim’s finger. The police arrested and charged members of the alleged gang involved. Many people in crypto now try to protect their safety by not posting about their holdings or location, says Scott Pounder, a former Met Police officer, who now works for digital asset recovery company Token Recovery.
But thefts don’t have to be so targeted or violent. Crypto is now so popular that there is a fair chance that a young man on the street will own some. In the UK, one in four people aged 18 to 34 own crypto, according to a survey last year. Men are three times as likely to do so than women.
There’s a fine line between convenience and common sense. Do you need everything that is on your phone on your phone?
The London thieves’ tactics seem to target this demographic — who are more likely to be confident enough to engage in conversation on the street after dark. Like d’Ippolito, Neil Kotak says he was walking home from a night out, when some men approached him. “They seemed pretty friendly, we were just talking. One of them asked me to take his number for the future. I logged in. At that point, they just grabbed my phone.”
The thieves “did not touch my bank accounts. They only went for my crypto account,” says Kotak. He tried to disable his phone, using a friend’s handset, but was unable to remember his Apple ID password. By then, he says, his crypto was being drained. He lost nearly £10,000 worth of crypto from Coinbase and Binance accounts.
For victims, there are mysteries in these thefts. First, how do thieves get around the crypto apps’ security? D’Ippolito says those who stole his phone reset his entire Apple ID. He is not new to crypto — he has worked promoting a Singapore-based crypto platform — and his crypto transactions required biometric ID: “I don’t know how they worked around this.”
Another mystery is more positive. Both Kotak and another victim of crypto theft, Alec Burns, had their losses reimbursed by Coinbase, the US-based exchange. This came as a surprise, and without an explanation. In response to the FT’s questions, a representative pointed to its terms and conditions which read: “Coinbase is not liable for any loss that you may sustain due to the compromise of your account login credentials”. Kotak also had some funds stolen from Binance; he says he is yet to receive a response from that exchange.
The biggest mystery is: can the assets be recovered? The blockchain, the ledger on which cryptocurrency is based, is famously public. Transactions are recorded.
So the idea that stolen crypto cannot be tracked is wrong, says Phil Ariss, a former City of London officer, who now works for TRM Labs, a blockchain intelligence company. TRM Labs sells software to the police and other law enforcement agencies. “When they do investigate [crypto theft], they investigate it exceptionally well,” says Ariss.
In practice, however, thieves often get away. The police in the UK lack the capacity or the specialist knowledge to follow stolen crypto. Ariss says most thieves “will use brick and mortar exchanges”, trying to cash out their crypto before law enforcement agencies have caught up with them.
At the more sophisticated end of the market, criminals have techniques for disguising the flows. North Korean hackers cashed out a significant portion of the $1.5bn worth of tokens that they stole from a Dubai-based crypto exchange in February.
Pounder, the former Met and City of London police officer, says that only a very small percentage of reported fraud is dealt with. In his recent work, he says he has reported 20 thefts to Action Fraud, the police’s specialist fraud unit, with supporting evidence. The police proceeded with none of the cases.
Burns says the Met police have made “almost negligible” progress with his case — even though he lost around $40,000, and even though he says the wallets that handled his stolen crypto can be linked to known entities. “After all that’s happened, I can understand why so many people move to places like Dubai,” he said on a podcast he co-hosts, Untangling Web3.
Burns’s guess is that the thieves are waiting for technology to develop in a way that allows them to extract it quickly, or for him to lose interest. “In 10 years, I probably won’t be watching that account,” he admits.
The Met Police advise people to protect their apps: turn on “stolen device” or “anti-theft” protection; use strong passwords for different apps; and watch out for people looking over you when you’re on your phone. TRM Labs operates a database — chainabuse.com — where people can report stolen crypto, which can then be flagged to prevent the assets being cashed in.
D’Ippolito has belatedly adopted a raft of security measures — including requiring Face ID to log into any of his apps. (No protection is perfect: in 2023, criminals drugged a Coinbase user and forced them to unlock their phone using Face ID. Five men were later jailed.) “As I’m starting to realise, there’s a fine line between convenience and common sense,” he says. “Do you need everything that is on your phone on your phone?”
He watches other people with their phones in their hands in public. “I see people oblivious to their surroundings. I don’t see it like that any more.” Would he give up on crypto? On the contrary, he said, it might be the quickest way to make his losses back.
Read more on Financial Times News
