Cyber criminal jailed over £2m crypto theft plot Glasgow 2026

Key Points

• Cybercriminal Robert Barr received an eight-year prison sentence for orchestrating a £2 million cryptocurrency robbery scheme while serving time at HMP Edinburgh.
• Co-defendants Sean Favier, 26, and Iain Doyle, 37, were jailed for four years and five years respectively for their roles in the operation.
• All three men previously pleaded guilty at the High Court in Edinburgh to charges of involvement in serious organised crime.
• Barr used encrypted messaging apps from inside his cell to direct targeted home invasion raids against cryptocurrency owners in Midlothian.
• The second break-in failed at 11:30 pm when the homeowners kept their front door locked and confronted the masked intruders using a Ring doorbell camera.

Glasgow(Edinburgh Daily) November 10, 2026 – A high-level cybercriminal who orchestrated a £2 million cryptocurrency theft plot while incarcerated in a Scottish prison cell has been jailed for eight years.

How was the £2m cryptocurrency plot orchestrated from inside a prison cell?

As reported by Grant McCabe of The National, Robert Barr directed an organised crime syndicate from his cell inside HMP Edinburgh to execute targeted home invasion raids against cryptocurrency holders located in Midlothian.

Appearing alongside Barr in the dock at the High Court in Glasgow, co-conspirators Sean Favier, aged 26, and Iain Doyle, aged 37, received prison sentences of four years and five years respectively. All three men had previously entered guilty pleas to charges of involvement in serious organised crime.

The court heard details of how Barr maintained communications with outside operatives using illicit mobile devices from behind bars.

As reported by Grant McCabe of The National, prosecutor Mr Dickson detailed to the court that when Barr’s mobile phone was seized by authorities on June 25, 2024, an inspection uncovered explicit details confirming Barr’s role in coordinating and offering specialist technical guidance to criminal associates conducting cryptocurrency thefts.

What occurred during the attempted physical raids on the victims’ property?

The prosecution outlined two distinct robbery attempts carried out against victims residing in Midlothian, with the initial raid taking place in January 2024. During the second attempt, accomplices Favier and Doyle approached the residence late at night.

As reported by Terence Zimwara of Bitcoin.com News, prosecutors revealed that Barr instructed an associate via messaging applications prior to the raid: “I’m going to send u a website for the boys to make him go on. If they need, phone me on Telegram. I can speak to them in house keep them right. When they’re in his house gonna need get him on his PC fast”.

Barr further instructed that remote control software, specifically AnyDesk, needed to be installed “rapid” to facilitate the immediate exfiltration of digital assets once access to the victim’s personal computer was secured.

The second attempted raid collapsed due to the vigilance of the homeowners. Looking outside at approximately 11:30 pm, the male victim observed two men dressed in dark clothing with their hoods pulled up. Instructing his wife not to open the door, the couple communicated with the intruders through their smart Ring doorbell device.

Court transcripts show that when the victim’s wife asked “Hello” through the system, Favier responded: “S’appnin, bro.” The second intruder looked directly into the camera lens and asked: “Is that a camera right in front of me?” Realising their identities were being recorded, the pair covered their faces and fled the property.

What were the statements made by the defense and the presiding judge?

During the sentencing proceedings, defense counsel presented mitigations regarding the involvement of the co-defendants.

As reported by Grant McCabe of The National, defense lawyer Michael Anderson KC, representing Barr, stated that: “It might be a source of frustration to a number of people that someone who has skills that are pretty unusual could not put them to better use and legally.”

The court was further informed that Favier and Doyle were not previously acquainted prior to the night of the second attempt, with Doyle having joined the operation without full awareness of the complete scheme.

In delivering the sentence, High Court Judge Lord Cubie condemned the nature of the crime.

As reported by Grant McCabe of The National, Lord Cubie stated that: “This was an attempted crime that married 21st-century computer sophistication with old-fashioned housebreaking in an audacious attempt to steal cryptocurrency of up to £2m. It was apparently devised and directed from a prison cell, only frustrated when the victims had sense not to open the front door at 1130pm to unknown men dressed in dark clothing with their faces obscured.”

Court reports noted that Barr smiled and laughed as he was led away handcuffed to commence his prison sentence.

Background of the particular development

Physical coercion targeting digital asset holders—often referred to in cyber security circles as “wrench attacks” or targeted home invasions—represents an evolving threat vector across the United Kingdom and internationally.

Unlike traditional bank accounts subject to institutional delays, fraud protection, and reversible transactions, cryptocurrency networks process irreversible transfers on public ledgers once private key credentials or remote computer sessions are compromised.

The utilization of illicit mobile communications within custodial facilities remains a critical vulnerability across correctional institutions.

Despite perimeter controls and security measures in Scottish prisons, access to encrypted messaging platforms such as Telegram enables incarcerated individuals to manage complex criminal enterprises, coordinate physical actions, and provide live technical support to operatives in real time.

Prediction: How this development can affect digital asset holders and security protocols

This legal precedent and the investigative findings associated with the case highlight critical operational shifts for both cryptocurrency investors and correctional facility security administrators:

1. Increased Adoption of Hardware Security: Holders of high-value digital assets will likely transition away from software-based wallets on primary personal computers toward multi-signature hardware setups. The explicit mention of remote-desktop tools such as AnyDesk in forced-entry scenarios underscores the vulnerability of personal computers during physical coercion.
2. Implementation of Enhanced Countermeasures: Asset management services will face increased demand for features tailored to mitigate physical extortion, such as time-locked transactions, duress PINs, and non-custodial multi-party computation (MPC) arrangements requiring multi-geographic approvals.
3. Heightened Custodial Security Measures: Police forces and penal institutions will likely intensify signal-jamming technologies, routine cell searches, and digital forensic audits within prison facilities to curb the unauthorized use of mobile hardware and encrypted applications by high-risk inmates.