Update: March 20, 12:30 am UTC: This article has been updated to include statements from Gabi Urrutia and David Birch.
A UK resident has accused his estranged wife of stealing 2,323 Bitcoin from his Trezor hardware wallet in 2023, alleging she used a security camera to capture his seed phrase and wallet access codes.
In a court judgment by Justice Cotter, filed in the UK’s High Court of Justice last Tuesday, lawyers acting for the claimant, Ping Fai Yuen, alleged that his wife, Fun Yung Li, and her sister covertly recorded him to obtain his seed phrase and transfer $176 million in Bitcoin (BTC) to 71 different addresses.
Gabi Urrutia, the field chief information security officer at Halborn, told Cointelegraph that in this case, the CCTV would have needed to capture the recovery phrase and other material that restored signing authority.
“Watching someone enter a device PIN alone is usually not enough to drain funds remotely, but capturing the wallet backup can be, because Trezor says the backup provides full access and can be used from a different device or wallet.”
After allegedly being tipped off by his daughter about the plot, Ping installed audio recording equipment and claims he captured Fun discussing the theft and how to move large sums of money without attracting the attention of banks or law enforcement.
No transactions have taken place at any of the wallet addresses since Dec. 21, 2023, according to the court documents.
Ping reported the alleged theft to the police shortly after the last transfer in December. Law enforcement arrested his wife and confiscated several cold wallets and watches. She was later released on bail while police investigated.
Authorities later stated there would be no “further action pending new evidence.”
Swytx's director of security, David Birch, told Cointelegraph that this case is another warning to crypto users that incidents involving physical threats or methodologies are becoming bolder and more common.
“The most important thing for hardware wallet users to understand is that you should avoid using your devices in public spaces or anywhere you could be recorded. It’s simply not worth the risk. You can get burned in crypto or regular banking if you don’t do basics like use complex passwords and unique pins,” he said.
Wallets have been targeted by dusting attacks
In November last year, nearly two years after the alleged theft, Ping applied for an asset preservation injunction, asking the court to freeze all cryptocurrency associated with his wife, formally declare his ownership of the Bitcoin and either return it or award him its equivalent value in fiat currency.
He also claimed to be monitoring the Bitcoin addresses and expressed concern that they had been targeted in a crypto dusting attack.
Dusting attacks involve a bad actor sending small amounts of cryptocurrency to wallets to track activity and try to identify the owners of wallets with large holdings for follow-up phishing and other scams.
A separate incident in September 2024 allegedly involved a violent confrontation between Ping and Fun, resulting in charges against Ping of assault occasioning actual bodily harm and two counts of common assault, to which he later pleaded guilty.
Judge says the husband has a high chance of winning
Justice Cotter wrote that Ping has a high chance of prevailing, given the evidence collected since the alleged incident occurred and the fact that Fun did not provide “any alternative (or any) explanation for the movement of the Bitcoin.”
Related: US Treasury sanctions enablers of North Korea IT worker fraud ring
“In my judgment the claimant has demonstrated a very high probability of success,” Cotter wrote, adding that “The evidence is that he was warned of what the First Defendant was seeking to do, the transcripts are damning; and when the First Defendant’s property was searched, the necessary equipment to exfiltrate the Bitcoin was found.”
Cotter also noted that if the pair cannot agree on how to proceed, the court will schedule a case management hearing. He also recommended an early trial, which he described as “necessary given the security threats to, and volatility of value of, the Bitcoin.”
Magazine: The debate over Bitcoin’s four-year cycle is over: Benjamin Cowen