A stolen iPhone became a gateway to financial loss for Magnus Ahmad, a former cryptocurrency executive whose experience illustrates how physical device security directly affects cryptocurrency holdings and financial accounts.
Ahmad lost approximately $14,000 after thieves took his unlocked iPhone outside a pub in London's Hackney neighborhood on August 8 shortly after 1 a.m. His cryptocurrency wallets, payment cards, and trading account were subsequently compromised.
Timeline of Unauthorized Activity
According to Ahmad's account, the theft occurred after two men he had been socializing with that evening gained sight of his phone's passcode. When one of the men asked to enter contact details into Ahmad's phone, he handed over his unlocked iPhone 14 Pro Max. A third man then grabbed the device and ran. Ahmad pursued the thief but was unable to recover it.
The financial damage followed quickly. By 1:53 a.m., cryptocurrency was being converted and transferred from his MetaMask wallet. His Phantom and Bybit accounts were also accessed.
By 3:22 a.m., six unauthorized card transactions had been completed, including more than $2,000 in purchases at Costcutter. The attackers accessed his eToro account and opened leveraged cryptocurrency positions representing nearly $44,000 in trading exposure, resulting in additional losses and costs.
Breakdown of Losses
Ahmad's estimated $14,000 total loss comprised approximately $9,500 in cryptocurrency, nearly $3,000 in unauthorized card charges, and more than $800 in eToro losses and costs. His larger bank balances and other cryptocurrency holdings remained intact after he froze cards and regained control of key accounts.
Device Security and Account Access
The incident illustrates how financial services and account recovery tools residing on a single device can create multiple vulnerabilities when that device is lost. For cryptocurrency users, the case raises a practical security question about how much financial access a phone should provide during everyday activities.
Ahmad's experience also highlights that cryptocurrency security depends not only on wallet protection but on the everyday devices used to access funds. The theft did not indicate a breach of the underlying wallet services or trading platforms themselves.
Protective Measures
Ahmad now carries an older iPhone with a separate Apple account and fewer apps when going out, reducing the number of services accessible through a portable device. Apple's guidance for stolen iPhones recommends marking the device as lost immediately, which locks the device and enables additional protections like Stolen Device Protection. Users are also advised to contact their financial institutions, mobile carrier, and police to report the theft.
Ahmad noted that securing his accounts from another device immediately after the theft would have been more effective than pursuing the thief. Securing a stolen device can help limit further exposure, but does not guarantee recovery of stolen cryptocurrency.
The broader concern extends beyond immediate financial loss. Photographs of identity documents stored on Ahmad's phone created an ongoing risk of identity fraud.
