Evan Luthra Says Kidnappers Drained $2M in Crypto in 30 Minutes

A Halloween Trip That Ended in a Heist

Crypto investor Evan Luthra says he was kidnapped in Oxford, England, on November 4, 2025, and lost more than $2 million in digital assets within 30 minutes. He recounted the attack in an interview published over the weekend, almost one year after the robbery. Luthra was in the UK for Halloween, an award ceremony at the House of Lords and a speaking event at Oxford University. He left the Oxford event with four friends in a private car, driven by a man booked through an acquaintance who had worked for him for several days. On the road to London, the driver turned into a secluded, tree-lined lane. Five masked men climbed in, punched Luthra and told the passengers they had come only for him. He said he understood within ten seconds that it was a kidnapping and that he would lose millions of dollars, so he chose not to resist. The attackers first took his Richard Mille watch, valued by police at about £450,000, then unlocked his phone with his own Face ID. From his Binance account they withdrew assets worth just over $1.5 million, and roughly $600,000 in Ethereum (ETH) left his Gate account before they tried his bank accounts. About half an hour later the group drove off with every phone in the car; police say the vehicle was abandoned in north Oxford's Five Mile Drive area. Thames Valley Police's charging notice describes a robbery on a vehicle traveling from Oxford to London, in which two men and three women had watches and phones taken and one victim was forced to transfer crypto worth $1.5 million. The notice does not name the victim and does not explain why the forced-transfer figure sits below Luthra's stated total of more than $2 million. One man, 24-year-old Abdul Malik Cali, was charged with five counts of conspiracy to commit robbery.

A Court Order Returned $370,000

The recovery effort shows how narrow the window is once stolen funds leave an exchange. Luthra said he could not warn his exchange contacts for hours: the group walked to a police station after the afternoon attack and was still giving statements past midnight, with no internet access the entire time. Exchanges can generally freeze assets only while the funds remain on their platforms, and the half-hour drain left most of the money beyond reach by the time he regained a connection. Once he reached his contacts, both Binance and MEXC acted. Binance returned roughly $370,000 through a court order obtained under the UK's Proceeds of Crime Act, the law that lets courts seize and return criminal proceeds; Luthra says it was the first POCA order involving the exchange. The London law firm Cooke, Young & Keidan secured the orders and handled the recovery. MEXC froze part of the stolen funds and shared data that supported the tracing work. In total, Luthra says he has recovered just under $1 million and declined to give the exact figure. In a post on X published on October 30, he noted that part of the stolen money had been frozen and that he still keeps almost $10 million on Binance. The case itself has slipped. Police arrested four men from London, Birmingham and Kent, aged 19 to 37, in November 2025 and released them on bail; Detective Sergeant Stuart McMaster described a “complex investigation” covering CCTV, number-plate cameras and financial inquiries. Cali was arrested at Heathrow Airport in December 2025 and remanded in custody. The trial had been due to open this month; it now moves to November 2027, because the court needs five weeks instead of four and no slot that long was available sooner. Luthra called the delay disappointing but said he understands the case needs to be handled properly.

@EvanLuthra · X post

A post on X.

View on X

The Oxford case shows both sides of the recovery ledger. The forced transfers moved through centralized exchanges, which is what made partial recovery possible: Binance's $370,000 return under a Proceeds of Crime Act order and MEXC's freeze happened because the money was still on platform when contact was made. Chainalysis's tally of wrench attacks, a record $58 million in 2025 and more than $30 million in the first half of 2026, points the other way: attackers increasingly know the window closes, and funds that reach a crypto mixer are far harder to follow. For a crypto whale who hodls seven-figure balances on exchanges, self-custody hardware such as Tangem Pay limits what an attacker can extract in person, though it does nothing for balances already on deposit.