ZachXBT Connects 3,670 ETH to Arrest of Suspect Danny Khan Amid Hack Investigations

British cybercrime suspect Danny Khan, also known as Danish Zulfiqar, has been reportedly arrested in Dubai following a raid that led to the seizure of cryptocurrency. On-chain investigator ZachXBT tracked the transfer of approximately 3,670 Ethereum to a specific wallet connected to this suspect, linking him to numerous criminal activities, including hacks that involved the theft from Genesis creditors and a significant SIM swap incident.

Key Takeaways

Arrest of Danny Khan: British suspect Danny Khan, alias Danish Zulfiqar, was detained in Dubai during a raid.
Ethereum Traced: ZachXBT identified 3,670 ETH linked to Khan, firmly rooted in criminal activities.
Criminal Connections: Khan's prior associations include a theft involving Genesis creditors and a SIM swap incident that breached significant financial institutions’ security.
Ongoing Investigation: Authorities have not yet confirmed the arrest, but reports indicate an active pursuit of the case.

ZachXBT links 3,670 ETH to suspect Danny Khan arrest in Dubai

Disturbing Connections to Hack Crimes

On-chain investigator ZachXBT announced via Telegram that the seizure of approximately 3,670 Ethereum took place on Friday. The funds were transferred to Ethereum wallet 0xb37d6…9f768, identified through tracking of multiple addresses associated with Danny Khan. "Not long ago, several addresses linked to him consolidated their funds into 0xb37d in a manner similar to previous law enforcement seizures," stated ZachXBT.

Tracking Criminal Activity from Nigeria to Dubai

Reports indicate that Khan was recently spotted in Dubai, where authorities conducted a raid on a villa, leading to the arrests of others present. Various sources claim that individuals connected to the incident have not replied to messages recently. Shortly after the reports surfaced, a superseding indictment confirmed Khan's arrest in Dubai.

ZachXBT has been following Khan's activities since 2024, tracing him back to a theft involving a Genesis creditor in August of that year. This alleged operation included co-conspirators Malone Lam, Veer Chetal, Chen, and Jeandiel Serrano, who executed a social engineering attack on an unidentified individual.

On August 19, 2024, this group allegedly impersonated support staff from Google and Gemini to manipulate the victim into resetting their two-factor authentication. They convinced the victim to transfer Gemini funds to wallets under their control and disclosed private Bitcoin keys using the remote desktop app AnyDesk.

Noteworthy Transactions

Transaction histories from Gemini, which were displayed in a Discord video appearing to show the conspirators celebrating their success, documented Bitcoin being transferred to addresses owned by the group. The stolen funds were reportedly split among the involved parties and circulated through over 15 cryptocurrency exchanges, where they converted between Bitcoin, Litecoin, Ethereum, and Monero.

Additionally, ZachXBT traced Khan's involvement in the August 2023 Kroll SIM swap incident. This breach exposed personal information of creditors from BlockFi, Genesis, and FTX and led to considerable financial losses through social engineering methods. Kroll acknowledged the breach, confirming that a hacker compromised an employee's T-Mobile account through SIM swapping.

Even though authorities have yet to officially verify Khan's arrest, reports suggest that the investigation is actively ongoing.