She Stole 2,300 Bitcoin With a Hidden Recorder. The Court Said It Wasn’t Theft.
Bezalel Eithan Raviv Founder & CEO Lionsgate Intelligence Network
The hacker didn’t use a hacker, didn’t use MalWare, and didn’t do anything with a zero-day exploit (a complex way of hacking).
She just had a recorder, a hearing device, and said 24 words in a place where she could hear them. That simple act of saying those 24 words resulted in moving 2,300 Bitcoin (worth 10’s of millions of dollars) from her husband’s cold wallet to a complex web of dozens of obscured addresses. The case (Ping Fai Yuen v Fun Yung Li) has already shocked the crypto community and the legal community. However, the ruling that came Out of the theft has proven to be even more shocking than the theft itself!
An English court ruled that, legally, this could not be considered “theft by conversion.”
Think about that for a minute…
What Is a Seed Phrase and Why Does It Matter So Much?
First, it’s necessary to determine what was taken, legally speaking. It is not everything that is true with respect to the language used to describe what has been stolen here.
A seed phrase/recovery phrase/mnemonic phrase is a string (12-24) of common words used to create your crypto wallet when you initially set it up. It’s the master key to everything in that wallet. Whoever has a seed phrase can restore the wallet on any device in any location and transfer every asset in that wallet with no further authentication required.
Seed phrases are not able to be reset with a “forgot my password” method. Seed phrases are also not able to be reset with two-factor authentication. You cannot call a bank to get a new seed phrase. The seed phrase itself is the asset in question here. The method of acquiring the seed phrase is through the most original form of social engineering: listening to someone talk who is unaware they are being recorded.
“The person with the seed phrase is the person with the asset. This isn’t just a metaphor; this is a forensic reality.”
– Bezalel Eithan Raviv (CEO & founder of Lionsgate Intelligence Network).
The Case: Ping Fai Yuen v Fun Yung Li
This amazing case has very few rules to follow but many incredible facts. First, the defendant is said to be married (which may or may not be true), and the victim is alleged to be her spouse. The defendant supposedly acquired her husband’s seed phrase by secretly recording him with an electronic device. After getting the seed phrase, the defendant used it to transfer all of the money from the victim’s cold wallet which is a physical piece of technology that can never be connected to the Internet and is the safest way to keep your cryptocurrency to as many as dozens of other unique wallets, dispersing the funds in such a manner so as to create a clear pattern designed to violate statutes such as money laundering, which are regularly applied by our financial experts here at Forensic Accountants.
The legal question that emerged: Is this theft?
According to normal property law in England, the tort of conversion (which is the civil law equivalent of theft) relates mainly to physical (or tangible) assets, i.e., the things you can touch, pick up, and transfer by handing them over. Examples of tangible assets would be a painting, a car, a gold bar, or a piece of paper with information on it.
According to the court, as it has been established that Bitcoin is an intangible property, there is no place for conversion upon the customary definition of theft as it relates to the digital asset type of property, and therefore it is not able to uphold a case based on definition and conversion as seen in the law.
With the enactment of the Property (Digital Asset) Act 2025, the Digital Assets Act codifies that digital assets represent property and possess legal property rights. The enactment of the Digital Asset Act is an important development in the area of digital real-property law. Prior to the new statute, the prior tort of conversion did not consider the class of digital assets or property therein; although the new law has defined digital assets as being property, the tort of conversion will not be recognized at this time; therefore, courts will not have an appropriate jurisdiction or means (e.g., legal standard) for handling a tortious action against another for conversion based on a digital asset.
The UK vs. the US: A Tale of Two Legal Frameworks
The disparity in treatment of cryptocurrency theft cases between England and America highlights the disparity in the worldwide legal system and that the location where a case is tried will impact the chance of recovering stolen cryptocurrencies.
Is Cryptocurrencies a form of Property?
United Kingdom: Yes. The Digital Assets Act (2025) gives cryptocurrency property status.
United States: Yes. Federal and state laws recognize cryptocurrencies as property.
Whether the Tort of Conversion Applies
United Kingdom: Not established as courts are currently developing definition; issues revolve around whether or not an intangible form of the Tort is applicable.
United States: Yes, Courts can consider evidence of whether or not control was had over the cryptocurrency being stolen, etc.
Regimes for Seizure / Forfeiture
United Kingdom: Being developed; limited because of extreme delays to conduct active investigations of cryptocurrency fraud.
United States: Well established; FBI, IRS-CI and HSI reclaim tens of billions of dollars of cryptocurrency each year during investigations.
Key Legal Question
United Kingdom: Is this tangible property?
United States: Who possesses control of the cryptocurrency’s private key?
Possible Recovery Methods
United Kingdom: Civil Injunctive relief or freezing assets
United States: Criminal Forfeiture, Civil Recovery, and Law Enforcement Action
Every year tens of billions of dollars’ worth of cryptocurrencies are seized by federal agencies such as the Federal Bureau of Investigation (FBI), Internal Revenue Service Criminal Investigations (IRS-CI), Homeland Security Investigations (HSI) and the Secret Service. Well defined procedures exist between these various agencies for the management, seizure, and ultimate return of these forfeited assets. Additionally, U.S. Courts have recognized Bitcoin as a type of property across numerous contexts, such as when declaring bankruptcy, conducting tax assessments, prosecuting fraud, prosecuting for money laundering, and/or freezing property.
Furthermore, instead of continuing on with existing philosophical debates surrounding the nature of intangible property, the United States is focused on answering a much more straightforward question: Who possesses controlling authority over the private keys needed for ownership of the Bitcoin?
Why “Control of the Keys” Is the Right Legal Standard
One way in which the American approach to cryptocurrency laws aligns with the reality of using blockchain technology is that cryptocurrency does not actually ‘move’; instead it moves via cryptographic authentication.
In order to authorize a transaction using cryptocurrency, the person must possess the private key associated with the cryptocurrency. This private key is derived from a “seed phrase” and only the holder of that private key can sign and validate a transaction.
To possess the seed phrase is similar to owning the actual physical item. Once the seed phrase is validated as an owner of the coins, the transaction itself cannot be undone; there are no charge-backs and no way to undo the transfer of ownership once the transfer is completed (i.e., now they are actually yours). Thus, the ownership has fully and completely passed from one person to another.
Furthermore, the seed phrase is not just a means of access to the coins; rather, in the blockchain world, the seed phrase is also the “deed” to the coins which are stored on the blockchain.
When courts examine the question of who owns the cryptocurrency, they are asking an important question that relates to how/where the coins exist/are kept in a decentralised economic environment; whoever controls the private key associated with the coins is therefore the owner of the coins.
“As control over digital assets on the blockchain has evolved into a form of possession, the courts are starting to understand that a new form of right to possess has emerged based not on having physical possession, but on having cryptographic authority.”
— Bezalel Eithan Raviv, Lionsgate Intelligence Network
What This Means for Crypto Victims Today
The legal environment you must navigate will significantly depend on the jurisdiction in which you operate as well as the nature and amount of evidence available regarding how you lost the cryptocurrency and how quickly forensic analysis can be performed after the loss occurs once you or your organization has suffered from cryptocurrency theft via social engineering (e.g., phishing), seed phrase exposure, exchange fraud, or investment scams.
Time Is the Enemy of Recovery
As soon as the Seed Phrase was applied in the Ping Fai Yuen case (and funds were sent to dozens of different locations), the quick movement of funds to multiple addresses signifies a deliberate obfuscation approach (this method occurs in similar manners with cases found in thousands of unique data points of our database). Each hour that passes without a forensic mapping to assist in tracing and recovering the funds makes it exponentially more difficult to do so as the funds continue to pass through mixer, exchange hops, and chain bridges to further conceal their origins.
Forensic Intelligence Is Not Optional It’s the Foundation
That means a forensic intelligence foundation is necessary to pursue civil injunctions through the English courts, partner with the U.S. federal law enforcement agencies and develop a civil asset recovery case. Courts and agencies and legal teams need:
- A complete on-chain map of each fund movement, starting from the original wallet down to all addresses where the funds were received.
- Depending on whether the addresses can be grouped together based on their patterns, test to see if any of those clusters are linked to known entities, exchanges and/or mixing services.
- Where possible, conduct attribution analysis and link the wallet activity to a real-world identity.
- Create a structured package of evidence that translates the blockchain data into a court-admissible form that can be used by the prosecutors, judges and investigators.
Jurisdiction Strategy Matters
Since each legal system has its own processing and investigation tools, where you choose to pursue recovery may be just as important as the evidence you have. In particular, U.S. law enforcement referrals to the IRS Criminal Investigation Division (CID) and the FBI can provide powerful avenues for seizure and forfeiture. Multiple civil recovery actions could also proceed in multiple jurisdictions simultaneously. Your forensic intelligence partner should have experience structuring a multi-tracking recovery strategy from the very beginning.
The Larger Question: Is the Law Ready for a 24-Word World?
The case of Ping Fai Yuen is indicative of a new trend in the litigation of digital assets.
With the increased interest in cryptocurrencies and the integration of digital assets into family wealth management, corporate treasury, institutional portfolios, and day-to- day personal/consumer finance, there will be an upwards trend in the number of disputes, thefts, and frauds involving digital assets. Courts across all jurisdictions will be required to address issues related to digital assets that were not addressed under earlier legal frameworks.
There are many challenges to face moving forward; however, there is already a clear trajectory for addressing these challenges. The 2025 Act has already created a very valuable benchmark as related to digital asset issues, and enormous strides have been made in terms of operational capabilities via U.S. courts and regulatory entities. International law enforcement agencies have greatly improved their cooperative efforts on a global scale, and tools to conduct blockchain forensics such as on-chain analytics, entity clustering, and behavioral pattern recognition will continue to improve.
However, there is still an extremely large gap between the existing state of the law as related to digital assets as compared to the state of financial crime perpetrated via digital assets.
The Lionsgate Intelligence Network tracks over $1.5 billion in suspicious funds per month across over 7,000 case analyses since 2022. The continued patterns seen through analysis provide a definitive conclusion: criminals understand how blockchain works; however, the legal system established to protect their victims is still trying to catch up. Forensic intelligence can bridge the gap between the two.
Some Things That Are Important
- The Seed Phrase (your recovery phrase) is NOT a password, but is practically the same thing as the asset itself losing it immediately for all intents and purposes (irrevocably).
- The 2025 Act recognizes digital assets as having property rights under the English legal system, while U.S. legal processes/means of enforcing rights of conversion have matured to the point where there is significant focus on the key control of digital assets in determining ownership.
- Forensic intelligence is not merely an option. Forensic intelligence is the evidentiary foundation that every route to recovery (legal route, civil piracy, or law enforcement) must satisfy in order to succeed.
- The time elapsing between a theft and the recovery of the stolen assets correlates closely with the costs and difficulty in recovering these assets.
Bezalel Eithan Raviv is the founder and CEO of the Lionsgate Intelligence Network (LGN), an Israeli-based blockchain forensic and financial crime intelligence company. Bezalel is a former Israeli Defense Forces Unit 8200 intelligence officer and leads a team that has worked cooperatively with the FBI, IRS-CI, DHS/HSI, U.S. Secret Service, and Europol to investigate financial crimes that involve cryptocurrencies. LGN has a (+) NATO NCAGE (#6557A) registration with SAM.gov and has performed over 7,000 analyses of suspicious funds, resulting in the identification of over $1.5 billion in suspicious funds, tracked monthly.
