Share article
Share article
Enjoy articles without ads?
Register for free and get unlimited access to all articles.
What the court heard
The uncomfortable bit: CCTV can defeat a hardware wallet
Hardware wallets are designed to keep private keys off internet connected devices. They are not designed to stop a camera. [2]
Most Trezor setups rely on a BIP39 seed phrase, typically 12 or 24 words, which can recreate the wallet on any compatible device. If someone obtains that seed, plus any additional passphrase if one is used, they do not need to "hack" anything. They can simply restore the wallet and sign transactions like the owner. [2]
That is what makes the CCTV allegation so plausible as a threat model. A fixed camera pointed at the wrong place can capture:
- A seed phrase written on paper during setup
- A "temporary" note with words or PIN hints
- The owner entering passphrases or recovery words
- The physical location of backups (drawers, safes, binders)
Where the on-chain evidence should show up (and where it might not)
A few realities worth spelling out:
- Bitcoin is transparent, but attribution is not. Without confirmed wallet addresses in the public record, outside analysts cannot reliably trace the funds. Court filings sometimes include addresses under confidentiality, especially if there is an active effort to freeze assets.
- A thief does not need a centralised exchange (CEX). Coins can be split across hundreds of UTXOs, moved through peeling chains, or routed into services designed to break heuristics.
- CEX off ramps remain a choke point. If any chunk touched a regulated exchange, disclosure orders can force identification, KYC records, IP logs, and withdrawal destinations. That is often where civil claims start to look winnable.
What makes this case unusual is the alleged method of compromise. If the court accepts that the seed phrase was captured and used, then the remaining questions become very practical: when did the transfers occur, where did the Bitcoin go, and who ultimately benefited.
Why UK courts are becoming a proper venue for crypto disputes
The UK has built a growing body of case law treating cryptoassets as property, enabling tools that matter in theft and fraud scenarios, including:
- Freezing injunctions to stop dissipation of assets (where identifiable)
- Disclosure orders against exchanges and intermediaries
- Proprietary claims that argue specific assets, not just damages, belong to the claimant
Justice Cotter's indication that the claimant has a strong chance of success hints the court may already be satisfied that there is a coherent evidential narrative, at least enough to justify expedited handling.
Still, civil success is not the same as instant recovery. Even if the claimant wins, enforcement depends on tracing assets to reachable venues, or proving the defendant controls wallets holding the Bitcoin (or proceeds).
This is what "operational security" actually means
People love to say "not your keys, not your coins." Fine. But the grown up version is: not your operational security, not your coins.
- No cameras in rooms where seeds are generated or stored. That includes smart doorbells with interior sightlines, baby monitors, and old CCTV kits that sync to cloud accounts.
- Use an additional passphrase (sometimes called a 25th word) that is never written down with the seed. A seed phrase filmed on CCTV is far less useful if the passphrase is not captured.
- Treat seed generation like a one time ceremony. No phones, no laptops, no guests, no "I will just jot it here for a sec."
- Consider multisig for serious size. A single seed is a single point of failure. Multisig moves the problem from "one secret" to "several secrets stored separately."
None of this is glamorous, but neither is explaining to a judge how your life savings were sitting one camera angle away from being drained. [1]
What happens next
An early trial recommendation usually means the court wants the factual issues tested quickly. Expect the key battlegrounds to be:
- Whether CCTV footage existed and what it captured
- Who had access to the recordings and accounts
- Timing analysis: marital separation timeline vs transfer dates
- Device and login artefacts (phones, cloud backups, email access)
- Whether any transfers can be tied to accounts controlled by the defendant
If specific wallet addresses are produced in proceedings, the on-chain element could become far more concrete, especially if funds passed through identifiable clusters or exchanges.
Risk box: what would invalidate the claim
This case turns on evidence, not vibes. The narrative weakens fast if any of the following becomes credible:
- Consent or shared control: proof the wallet was jointly managed, or that the claimant authorised transfers
- No clear linkage between alleged CCTV capture and subsequent transactions
- Inability to trace the 2,323 Bitcoin to the defendant or destinations under her control
- Alternative access paths: others with seed access, compromised backups, or earlier leaks that explain the drain without the CCTV theory

