Source publication: November 9, 2026, at 15:18 (UTC+8).
Crypto investor Evan Luthra was identified as the victim of a November 2025 kidnapping and robbery near Oxford, England, in which attackers allegedly forced him to transfer more than $2 million in crypto assets. The account, written by Ma He of Foresight News and published by PANews, draws on Luthra’s exclusive interview with BeInCrypto.
The reported transfers originated from Binance and Gate accounts. Some proceeds subsequently reached MEXC, while intervention by exchanges and a UK court enabled a partial recovery. The sequence illustrates the distinction between an exchange’s ability to restrict assets it still controls and the difficulty of recovering funds after they move elsewhere.
Coercion at the account-access layer
According to Luthra, he was returning to London with four companions on the afternoon of November 4, 2025, after activities associated with the University of Oxford. A familiar intermediary had arranged the driver, who had already worked for him for several days.
The vehicle turned onto an isolated, tree-lined lane, where five masked men entered. Luthra said they beat him and told the other passengers that they were not the targets. He surrendered control of his devices and assets rather than resist.
The attackers allegedly took a limited-edition Richard Mille watch, subsequently valued by police at approximately £450,000. They then used facial recognition to unlock his phone and transferred more than $1.5 million in assets from Binance and approximately $600,000 in ether from Gate. They also attempted to access his bank accounts.
The incident lasted about 30 minutes. The attackers left with all the passengers’ phones, according to the account. Some stolen funds were later deposited at MEXC.
Luthra suspected that the intermediary who arranged the driver might have participated in planning the attack. That suspicion was not presented as an established finding.
Partial recovery depended on exchange intervention
After the attack, Luthra and his companions walked to a nearby police station, where statements continued past midnight. He said the hours without a phone or contact with trading platforms reduced the opportunity to freeze funds.
In retrospect, he told BeInCrypto, returning to his hotel and contacting exchange personnel from a computer might have enabled a larger freeze. That is his assessment, not a demonstrated alternative outcome.
Luthra subsequently reached Binance and MEXC through contacts. Both exchanges helped freeze some funds and supplied tracing information, according to the report.
Binance returned approximately $370,000 following an order issued by a UK court under the Proceeds of Crime Act, or POCA. The article describes this as the first POCA asset-recovery order involving Binance in UK judicial history. London disputes law firm Cooke, Young & Keidan handled the matter. MEXC also froze some funds and provided information about subsequent movements, but the report does not specify the amount frozen there.
The custody distinction matters: an exchange can generally freeze assets remaining within its control. Once funds are withdrawn to non-custodial addresses or routed through bridges or mixing protocols, freezing and recovery become more difficult. The reported Binance recovery establishes a specific partial return—not recovery of the full loss or a general guarantee of reimbursement.
Arrests reported, trial postponed
Thames Valley Police Detective Sergeant Stuart McMaste said the investigation covered CCTV, automatic number-plate recognition, digital forensics and crypto-asset tracing.
Police arrested four men aged between 19 and 37; all four were subsequently released on bail. The report says the trial had been postponed until November 2027. Police had not previously made the victim’s identity public.
Luthra attributed his targeting partly to his visible public profile. The article describes him as a general partner at KOL Capital with 2.339 million Instagram followers, who publicly claimed investments in more than 1,000 crypto projects and displayed expensive watches and large exchange balances.
Physical attacks bypass technical safeguards
Such incidents are commonly called “wrench attacks”: violence or coercion directed at asset holders rather than exploitation of a software vulnerability.
A CertiK report published in July 2026 recorded 52 verified attacks worldwide during the first half of that year, up 33.3% from 39 in the first half of 2025. Associated financial exposure reached approximately $124.1 million, compared with about $10.5 million a year earlier. That measure included ransom demands, forced transfers, frozen funds and recoveries; it should not be read as a total of realized losses.
Home invasions increased from one to 20, while kidnappings rose from 12 to 16. Europe accounted for 39 of the 52 incidents, or 75%, compared with 35.9% a year earlier.
The article also cites Chainalysis’s assessment that attackers in 2026 increasingly selected people with identifiable public profiles, substantial balances and assets that could be moved quickly.
Luthra’s account centers on that access risk: the attackers allegedly compelled a person to unlock a device and surrender control over exchange-held assets. Subsequent tracing and legal action recovered part of the money, but did not undo the physical attack. He said money and watches could be replaced, while life and permanent bodily injury could not.