The manipulators of liquidity in the cryptocurrency space ultimately face physical harvesting in the real world.

Written by: Maher, Foresight News

Recently, according to BeinCrypto, crypto investor Evan Luthra has been revealed as a victim of a kidnapping and robbery case in Oxford, UK, in November 2025. Five masked men forced him to transfer over $2 million in crypto assets within about 30 minutes and stole a limited edition Richard Mille watch.

Luthra detailed the incident, the whereabouts of the funds, and subsequent recovery progress in an exclusive interview with BeinCrypto. Prior to this, the police had never disclosed the identity of the victim, and the trial of the case has been postponed until November 2027.

Evan Luthra

High-profile flaunting of wealth, KOL round dumping

Evan Luthra is one of the most publicly visible investors in the crypto industry. He claims on Twitter to have made the Forbes 30 Under 30 list multiple times and currently serves as a general partner at KOL Capital.

He boasts 2.339 million followers on Instagram, boldly claiming to have invested in over 1,000 crypto projects, frequently showcasing luxury watches and a social life among celebrities.

However, he has long been controversial in overseas communities for “buying list marketing, KOL round dumping, and high-profile wealth flaunting.”

His business model can be regarded as a reverse textbook example of Web3 traffic monetization and harvesting.

On one hand, he relies heavily on exaggerated buying list marketing and persona—often displaying the ‘Forbes 30 Under 30’ title and frequently showing off a £450,000 Richard Mille limited edition watch and screenshots of trading platform funds worth tens of millions of dollars, building a social filter of top high-net-worth big shots.

On the other hand, his unappealing KOL round dumping in the secondary market has long angered retail investors.

The most typical example is the 2023 Web3 social project ReelStar (REELT) incident: the community questioned Luthra, acting as an advisor to the project, who after receiving early token shares, dumped 1.3 million tokens into the market within two hours of opening, directly causing the token price to crash 60% in an instant.

The manipulators of liquidity in the cryptocurrency space ultimately face physical harvesting in the real world.

Acquaintances orchestrate the scene, stealing $2 million in crypto assets

Luthra revealed in an interview with BeinCrypto that on the afternoon of November 4, 2025, after finishing activities related to the University of Oxford in the UK, he was riding back to London with four companions.

The driver was arranged by a familiar intermediary who had served him for several days. During the return trip, the vehicle suddenly turned into a secluded lane with dense trees on both sides. Five masked men immediately entered the vehicle, assaulted Luthra, and made it clear to the others in the car that they were not the targets.

Luthra stated that confronted by the five masked assailants, he chose to surrender and relinquish control of his devices and assets.

The robbers first took his limited edition Richard Mille watch, which the police later valued at about £450,000. They then unlocked his phone using facial recognition, transferred over $1.5 million in assets from his Binance account, and moved about $600,000 Ethereum from Gate. They also attempted to access his bank accounts. The entire process lasted about half an hour before the assailants took everyone's phones in the car and left. After the robbery, the robbers also transferred part of the stolen funds into the relatively lax MEXC as a laundering transit station.

Afterward, Luthra and his companions walked to the nearby police station to report the incident, their statement lasting until after midnight.

The hours lost due to the phone being stolen and losing contact with trading platforms became a critical period for the loss escalation during the robbery.

He stated, “Looking back, this is my biggest mistake. If I could have returned to the hotel to contact the trading personnel I knew through my computer, I think I could have frozen more funds.”

Exchanges can typically only freeze assets while they are still on the platform; once funds are withdrawn to non-custodial addresses, cross-chain bridges, or mixing protocols, the difficulty of judicial freezing and on-chain tracking increases exponentially.

Later, Luthra contacted Binance and MEXC through acquaintances, both exchanges assisted in freezing part of the funds and provided tracking information.

Binance returned about $370,000 through a court order issued under the Proceeds of Crime Act (POCA) in the UK. This was the first POCA asset recovery order involving Binance in British judicial history, completed by the well-known London dispute resolution law firm Cooke, Young & Keidan (CYK). MEXC also froze some funds and synchronized subsequent flow data.

Detective Sergeant Stuart McMaste of the Thames Valley Police stated that the police have launched a comprehensive investigation into the related crimes, covering surveillance cameras, license plate recognition, digital forensics, and tracking of crypto assets. Subsequently, four men (aged between 19 and 37) were arrested, all of whom were later released on bail.

Luthra believes that his public identity is a significant reason for becoming a target. “They already know who I am, and I have disclosed a lot about my public image.” He suspects that the intermediary who arranged the driver may have been involved in planning the crime.

Wrench attack incidents increased by 33.3% compared to the first half of 2025

Such acts that use physical violence or coercion to force holders to surrender cryptocurrency assets are typically referred to as "wrench attacks" in the industry. Unlike traditional hacking attacks, they do not rely on technical vulnerabilities but instead directly target individuals and devices.

A report released by CertiK in July 2026 recorded that there were 52 verified wrench attacks globally in the first half of the year, an increase of 33.3% compared to 39 in the first half of 2025; the relevant financial exposure (including ransom demands, forced transfers, freezes, and recoveries) was approximately $124.1 million, a significant increase from about $10.5 million in the same period last year. Notably, home invasions rose from 1 in the first half of 2025 to 20, and kidnappings increased from 12 to 16.

Europe has become the region with the highest concentration of wrench attacks globally. CertiK data shows that in the first half of 2026, the proportion of cases in Europe skyrocketed from last year's 35.9% to 75%, with 39 out of 52 cases occurring there.

In January 2025, Ledger co-founder David Balland and his wife were kidnapped in France, with the attackers demanding a high ransom.

Such incidents have also occurred in North America.

In September 2025, two Garcia brothers from Texas broke into a home in Minnesota, binding a family of three at gunpoint for over nine hours, forcing the father to transfer over $8 million in crypto assets, and driving him to another location to retrieve a hardware wallet. The two pleaded guilty in June 2026 and were sentenced to 15 and 15.5 years in prison, respectively, in October.

The physical safety threats faced by high-net-worth individuals in the crypto space are no longer limited to kidnapping and extortion but increasingly escalate to deadly homicides.

In October 2025, in Dubai, UAE, a Russian named Roman Novak, who had been sentenced for crypto fraud, and his wife were lured out by individuals posing as “investors” to a villa. After the attackers demanded the wallet and found it empty, they killed both and dismembered them, abandoning the bodies in the desert. Russian investigators stated that the crime gang had begun planning in May 2025, with the final plan confirmed about two months prior.

In January 2026, in Milan, Italy, former Ukrainian banker Alexandru Adarici was killed during a kidnapping suspected of extorting about €250,000 in crypto assets.

Chainalysis pointed out that in 2026, wrench attackers are more inclined to target individuals with a clear public identity, higher balances, and the ability to quickly transfer assets.

Public high-net-worth identities, frequent disclosures of travel plans, and significant asset retention in centralized trading platforms objectively increase the probability of being specifically targeted.

Luthra later stated that money and watches can be earned and bought again, but life and permanent bodily harm cannot be recovered.

The trial of the case has been postponed until 2027, and the victim must wait a long time to enter formal judicial proceedings.