<p>On-chain sleuth ZachXBT traces 3,670 ETH to suspect Danny Khan as Dubai raid, Genesis creditor theft and Kroll SIM swap links surface amid U.S. indictment.</p>
<div id="cn-block-summary-block_28768789aeaa79cc29465c6a7877ebc8" class="cn-block-summary">
 <div class="cn-block-summary__nav tabs">
  <span>Summary</span>
 </div>
 <div class="cn-block-summary__content">
  <ul>
   <li>ZachXBT flags 3,670 ETH consolidated into a tracked wallet, mirroring past law enforcement seizures tied to Danny Khan.<a href="https://crypto.news/wp/wp-admin/post-new.php" target="_blank" rel="noopener noreferrer nofollow"></a>​</li>
   <li>Khan and alleged co-conspirators face a superseding indictment over a Genesis creditor theft using fake Google and Gemini support plus AnyDesk access.<a href="https://crypto.news/wp/wp-admin/post-new.php" target="_blank" rel="noopener noreferrer nofollow"></a>​</li>
   <li>The group allegedly laundered BTC, LTC, ETH and XMR across 15+ exchanges and is linked to the 2023 Kroll SIM swap affecting BlockFi, Genesis and FTX data.</li>
  </ul>
 </div>
</div>
<p>British cybercrime suspect Danny Khan, also known online as Danish Zulfiqar, has reportedly been detained in Dubai, with authorities allegedly seizing cryptocurrency after approximately 3,670 Ethereum were transferred to a tracked wallet, according to reports.</p>
<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
 <div class="wp-block-embed__wrapper">
  <blockquote class="twitter-tweet">
   <p>Update: A superseding indictment from a few hours ago confirmed my analysis that Danny / Danish Zulfiqar (Khan) was arrested in Dubai.<br><br> Seizure address<br> 0xb37d617716e46511E56FE07b885fBdD70119f768 <a rel="noopener noreferrer nofollow" href="https://t.co/rvX5U38nBW">pic.twitter.com/rvX5U38nBW</a></p>— ZachXBT (@zachxbt) <a href="https://twitter.com/zachxbt/status/1998267579136455090?ref_src=twsrc%5Etfw" target="_blank" rel="noopener noreferrer nofollow">December 9, 2025</a>
  </blockquote>
 </div>
</figure>
<p>On-chain investigator ZachXBT reported via Telegram channel that approximately 3,670 Ethereum were transferred into Ethereum wallet 0xb37d6…9f768 on Friday, where the funds were subsequently identified. “Several hours ago multiple addresses tied to him I was tracking consolidated funds to 0xb37d in a similar pattern to other law enforcement seizures,” the investigator stated.</p>
<h2 class="wp-block-heading" id="zachxbt-tracks-scammers-from-lagos-to-dubai">ZachXBT tracks scammers from Lagos to Dubai</h2>
<p><a href="https://crypto.news/hackers-steal-3-05m-xrp-from-cold-wallet-zachxbt-traces-funds/" rel="noopener noreferrer nofollow">ZachXBT</a> reported that Khan was last seen in Dubai, where authorities allegedly raided a villa and arrested others present. Multiple sources indicate those involved have not responded to messages in recent days, according to the report.</p>
<p>A superseding indictment issued hours later confirmed that Danny Khan, also known as Danish Zulfiqar, was arrested in Dubai, according to the investigator.</p>
<p>The on-chain investigator had been tracking Khan since 2024, linking him to a theft from a Genesis creditor in August 2024. The alleged scheme involved co-conspirators Malone Lam, Veer Chetal, Chen, and Jeandiel Serrano, who executed a social engineering attack on an unnamed individual, according to the report.</p>
<p>On August 19, 2024, the group allegedly impersonated Google and Gemini support staff, convincing the victim to reset two-factor authentication, transfer Gemini funds to wallets they controlled, and share private Bitcoin keys via the remote desktop application AnyDesk, according to the investigator’s findings.</p>
<p>Gemini transaction records, featured in a Discord video purportedly showing the conspirators celebrating, displayed Bitcoin moved to addresses controlled by the group, according to the report.</p>
<p>You might also like: <a href="https://crypto.news/tajikistan-eyes-8-year-prison-terms-for-bitcoin-mining-with-stolen-power/" rel="noopener noreferrer nofollow"> Tajikistan eyes 8-year prison terms for Bitcoin mining with stolen power </a></p>
<p>The stolen funds were reportedly divided among the conspirators and cycled through over 15 cryptocurrency exchanges, with conversions made between Bitcoin (<a href="https://crypto.news/price/bitcoin/" rel="noopener noreferrer nofollow">BTC</a>), Litecoin (<a href="https://crypto.news/price/litecoin/" rel="noopener noreferrer nofollow">LITE</a>), Ethereum (<a href="https://crypto.news/price/ethereum/" rel="noopener noreferrer nofollow">ETH</a>), and Monero (<a href="https://crypto.news/price/monero/" rel="noopener noreferrer nofollow">XMR</a>), according to ZachXBT.</p>
<p>ZachXBT also linked Khan to the August 2023 Kroll SIM swap incident, which exposed personal data of BlockFi, Genesis, and FTX creditors and resulted in significant losses via social engineering. Kroll confirmed the breach, stating a hacker had accessed an employee’s T-Mobile account through SIM swapping.</p>
<p>Authorities have not officially confirmed Khan’s arrest, though multiple sources indicate the case is actively being pursued, according to reports.</p>
<p>Read more: <a href="https://crypto.news/eth-whales-scoop-934k-tokens-in-3-weeks-while-small-holders-dump-supply/" rel="noopener noreferrer nofollow"> ETH whales scoop 934k tokens in 3 weeks while small holders dump supply </a></p>

ZachXBT tracks 3,670 ETH as Danny Khan arrest ties to Genesis, Kroll hacks

Table of Contents

crypto.news

Other articles published on Dec 10, 2025

Join our free newsletter for daily crypto updates!