In the late afternoon of March 16, 2022, Yuchen “Cassandra” Shi was alone in her Bernal Heights home when a masked man broke in. The knife-wielding figure was frightening enough, but his balaclava, ski goggles, and blue surgical gloves were particularly menacing.
After he forced Shi to a chair and bound her with duct tape and zip ties, he threatened her at knifepoint. But he didn’t want jewelry or cash. Instead, he sought something far more valuable—and far easier to steal with a few keystrokes: her cryptocurrency.
Throughout the ordeal, the man didn’t speak. Instead, he typed his demands into an (opens in new tab) iPad and held the screen up for Shi to read. Terrified, she complied, logging into her crypto wallets and emptying them of $3 million in assets.
After the transfer was completed, the man grabbed Shi’s cellphone and disappeared.
A screenshot of Tianze Zhang as he is escorted by Taiwanese officials after his arrest.
The San Francisco Police Department responded that evening, sending an inspector from the burglary unit. What started as a simple home invasion would evolve into an international manhunt involving the SFPD’s burglary and CSI units, as well as its federal liaison officers, a private investigator, crypto analysts, the FBI, Taiwanese authorities, and Interpol.
It was the city’s first high-profile example of “wrench attacks,” an emerging category of crime in which perpetrators rely on physical threats and violence — rather than technical hacking — to steal crypto. Dozens of incidents have occurred in the last year in major cities around the world.
In November, there was a violent home invasion in San Francisco (opens in new tab) that was eerily similar to Shi’s account from three years prior. A man posing as a delivery driver rang the doorbell of a Mission home, pulled a gun, and tied the resident with duct tape in an attack authorities say led to the theft of $11 million in cryptocurrency.
‘Owning crypto is a little bit like storing all your money in cash under your mattress.’
Computer security expert David Wagner
Now, newly obtained police documents shed light on the case of Shi, who works for the opaque crypto-focused venture capital firm D1 Ventures (opens in new tab), according to her LinkedIn (opens in new tab) profile. These files detail how law enforcement agencies investigated and chased a suspect halfway around the world in a pursuit that led to the arrest and repatriation of Tianze Zhang, Shi’s former personal assistant, in June 2022. Zhang has pleaded not guilty and denies the allegations.
Invasion investigation
“Owning crypto is a little bit like storing all your money in cash under your mattress,” UC Berkeley computer security expert David Wagner told The Standard last year. “It’s open for theft.”
The investigation into Shi’s home invasion was handed to Sgt. John Hallisy in the SFPD’s Burglary Unit. According to the police reports obtained by The Standard, Hallisy did a walk-through of the scene with Shi, then recorded an interview with her.
Police collected physical evidence, including the tape and zip ties used to bind Shi and remnants of the gloves worn by the suspect. Crime-scene investigators swabbed the items for DNA.
Officers soon obtained doorbell camera footage taken earlier that day of the suspect at Shi’s door, wearing a balaclava and ski goggles. But it provided few clues about who was behind the mask.
That same day, Shi began telling friends about the robbery and sharing the image of the man at her door. Among the people she contacted was Zhang, according to the SFPD documents. The former assistant, whom she considered a friend, replied to her message later, writing that he was “taking acid in Joshua Tree with two random women.” He followed up with a call saying he’d been on an LSD-fueled retreat and was soon heading to Taiwan to work on a film.
A headshot of Zhang issued by Interpol. | Source: Courtesy INTERPOL
Shi hired a private investigator named Carlos Jackson, a decision that soon paid off. Jackson obtained a video, taken by a neighbor’s security camera, that appeared to capture someone walking in the area around the time the crime occurred, according to police documents.
Five days later, Shi told police she’d identified the man in her neighbor’s video as Zhang. She said he had left her employment the month prior, and they were on good terms. Shi said she met Zhang in 2021 through a friend and had paid him via crypto. Zhang — who occasionally stayed in her home when she was traveling — might have had a house key, Shi told police.
Shi did not respond to a request for comment.
The next step of the investigation gave officers key evidence that placed Zhang near the scene of the crime. Cellphone data showed that his device pinged a cell tower near Shi’s house the day before and the day of the reported break-in, police documents show.
Meanwhile, police were trying to track down where Shi’s crypto had been sent. The SFPD first contacted the FBI, which tracked the transfer of funds from her wallet. Shi ran a parallel investigation, paying for a blockchain analytics report from a San Francisco company called Arkham Exchange, (opens in new tab)which tracks (opens in new tab) crypto wallet transactions.
The report, which Shi handed over to police, can function as a digital fingerprint tracker that allows investigators to follow the movement of funds, even when the owners’ identities are obscured.
Shi enlisted another company, CipherBlade, which specializes in forensic blockchain investigations. The firm provided police with deposit addresses and transaction IDs, which allegedly traced how Zhang sent money from Shi’s account to his own wallet.
CipherBlade, which did not respond to a request for comment, bills itself as a liaison between crime victims and police, specializing in recovering stolen assets. The SFPD used that information to get a court order requiring cryptocurrency exchange Binance (opens in new tab) to freeze the funds.
By March 23, 2022, officers had enough evidence to get an arrest warrant for Zhang.
‘These allegations that have been in the paper have been there as if they are gospel. I am telling you they are not.’
Defense attorney David Cohen
An SFPD inspector found that a flight register showed Zhang had boarded a plane to Taiwan on March 17, the day after the robbery.
With the aid of the FBI, the SFPD contacted Taiwanese authorities to inform them about Zhang, a U.S. passport holder who lives in Los Angeles and is originally from China, police documents show.
Two days after the arrest warrant was issued, Taiwanese police started their own investigation into Zhang for issues unrelated to the San Francisco heist. They alleged that he stole money from a business associate in the country, according to local news reports and a report Shi’s investigator gave to the SFPD.
By March 29, Interpol had been notified and issued a warrant for Zhang’s arrest.
Arrest and repatriation
After Taiwanese police opened their case against Zhang in late March, local news reports said he had cashed some of Shi’s crypto and used it to pose as a wealthy businessman to a woman whom he met on a dating app. With her help, he allegedly moved from city to city across Taiwan, at times hiding in the trunk of a car.
On May 30, Taiwanese authorities arrested Zhang as he was preparing to flee by boat to the Philippines. Reports said he still possessed most of the stolen funds, stored on USB wallets (opens in new tab). He told police the matter was a misunderstanding, not a crime.
Surveillance footage of Zhang, right, crawling out of the back of a vehicle while in hiding in Taiwan.
Two San Francisco investigators arrived June 1 in Taiwan, where local authorities turned over a handcuffed but cooperative Zhang on the jetway. He was flown back to the U.S. and charged with six felonies, including aggravated kidnapping, assault with a deadly weapon, burglary, and criminal threats.
Zhang’s side of the story
Zhang, who for the first time is speaking about the case via his lawyer David Cohen, has pleaded not guilty. Cohen denies the police’s version of events, characterizing Shi as a jilted lover whose story is full of holes. According to Cohen, Shi denies that she and Zhang had been in a romantic relationship.
“These allegations that have been in the paper have been there as if they are gospel. I am telling you they are not,” said Cohen.
The attorney points to several purported inconsistencies in Shi’s testimony and the police investigation. Doorbell footage of a masked man is timestamped at 5 a.m., he claims, putting it hours before the reported home invasion. He says Shi claimed her assailant released her, which raises questions in his mind about why the thief would do that.
A Taiwanese police report alleging Zhang stole funds from a business partner. | Source: Courtesy SFPD
Cohen also questions the grainy neighbor video police and Shi used to identify Zhang and said his client’s trip to Taiwan was for film work, not to flee the country. He said Shi’s account continues to shift, including a claim that Zhang sent her a confession letter from jail; Cohen said handwriting and postal markings do not support this. Prosecutors, he said, have yet to present clear evidence that Zhang transferred Shi’s money to himself. “It’s not clear that a theft actually occurred,” he said.
A spokesperson from the district attorney’s office declined to comment beyond saying, “This case has not yet gone to preliminary hearing, and we will not be litigating it in the press.”
Since Zhang’s arrest in 2022, the case has languished. Zhang, who spent more than four years in San Francisco’s county jail, has had two lawyers and tried repeatedly to get mental health diversions. He was released last month pending trial.
If convicted of kidnapping for ransom, the most serious charge, Zhang could face life in prison.
As a condition of his release, a home owned by Zhang’s family was put up as collateral. If he flees, the property can be sold to repay Shi.