Robber Posing as Courier Steals $11 Million Cryptocurrency in San Francisco

An armed robbery occurred in San Francisco on 22 November, where $11 million in cryptocurrency was stolen. The suspect, disguised as a courier, tied up the victim and forced them to reveal their digital wallet access.

The incident happened near 18th and Dolores streets in the Mission Dolores area.
The robber used a firearm and restrained the victim with tape before demanding cryptocurrency wallet passwords.
This type of crime is referred to as a "wrench attack," targeting cryptocurrency holders.

Jameson Lopp from Casa tracks such physical attacks and noted a 65% increase in incidents, with 61 cases reported globally in 2025 compared to 38 in 2024.

Recovery Challenges

Cybercrime consultant David Sehyeon Baek highlighted that authorities focus on tracking devices and freezing assets within the first 24 to 72 hours.
However, recovery of stolen funds is challenging due to quick, anonymized transfers by attackers.

Similar Tactics

The San Francisco robbery mirrors other incidents, including a UK case where perpetrators disguised as couriers stole $4.3 million using similar tactics.
Investigators found evidence of premeditated surveillance in the UK case.

The police report did not confirm any injuries or arrests related to this case, and San Francisco police have not commented publicly.