{"investigation":{"slug":"kroll","entity_name":"Kroll","trust_score":18,"severity_base":null,"score_modifier":0,"confidence":1,"status":"published","content_type":"investigation","summary":"Kroll Restructuring Administration LLC served as the court-appointed claims and noticing agent for the FTX, BlockFi, and Genesis bankruptcy proceedings. On August 19, 2023, a threat actor executed a SIM swap attack against a Kroll employee's T-Mobile account, gaining unauthorized access to files containing the personal data of tens of thousands of crypto bankruptcy claimants. The exposed data was subsequently exploited in large-scale phishing and social engineering campaigns, with blockchain investigator ZachXBT estimating total losses attributable to the breach at eight to nine figures, and at least one alleged perpetrator — Danish Zulfiqar, also known as 'Danny' — was arrested in Dubai in late 2025 on RICO charges related to a broader $263 million social engineering conspiracy.","sections":[{"content":"Kroll Restructuring Administration LLC is a subsidiary of Kroll, a global financial and risk advisory firm. In the aftermath of the 2022 crypto market collapse, Kroll was appointed as the court-authorized claims and noticing agent in three major cryptocurrency bankruptcy cases: FTX Trading Ltd., BlockFi Inc., and Genesis Global Holdco LLC. In this capacity, Kroll maintained sensitive personally identifiable information (PII) for hundreds of thousands of claimants, including names, home addresses, email addresses, and account balances. Kroll's dual role as both a data custodian and the sole communication conduit for claimants created a concentrated point of failure that was later exploited.","heading":"Background: Role in Crypto Bankruptcies","sources":[],"severity":"medium"},{"content":"On August 19, 2023, a threat actor executed a SIM swap attack targeting a Kroll employee's T-Mobile phone number. According to Kroll's public disclosure, T-Mobile — without any authorization from Kroll or the affected employee — transferred the employee's phone number to a device controlled by the attacker. This allowed the attacker to bypass SMS-based multi-factor authentication and gain access to Kroll's cloud-based systems. The files accessed contained PII of bankruptcy claimants across three matters: FTX, BlockFi, and Genesis. Kroll disclosed the incident on August 25, 2023. The firm stated that no passwords, financial account information, or KYC documents stored by FTX were present on Kroll's systems, but the exposed data — including names, addresses, emails, and claim amounts — was sufficient to enable targeted phishing. The average black-market price to SIM-swap a T-Mobile number at the time was reportedly approximately $1,500, per reporting by Krebs on Security.","heading":"The August 2023 SIM Swap Incident","sources":[],"severity":"medium"},{"content":"Within hours of breach notification emails being sent to affected claimants on August 25, 2023, recipients began reporting sophisticated phishing emails spoofing FTX and BlockFi. One widely reported phishing message stated: 'You have been identified as an eligible client to begin withdrawing digital assets from your FTX account.' Blockchain investigator ZachXBT publicly stated in January 2025 that the Kroll breach led to 'eight to nine figures' stolen by cybercriminals via email phishing campaigns and social engineering scams targeting bankruptcy claimants. ZachXBT also alleged that a lead suspect — Danish Zulfiqar, aka 'Danny' or 'Meech' — was directly involved in the Kroll SIM swap and that losses tied to resulting social engineering campaigns exceeded $300 million. These figures are attributed primarily to ZachXBT's on-chain analysis and have not been independently verified through court records or regulatory filings. Lead plaintiff Jacob Repko, named in the August 2025 class action, alleged he lost 1.9 ETH in July 2025 after a phishing attack exploiting data from the Kroll breach diverted funds he was attempting to transfer.","heading":"Phishing Campaigns Against Claimants","sources":[],"severity":"medium"},{"content":"Blockchain investigator ZachXBT tracked approximately 3,670 ETH that was consolidated to wallet address 0xb37d617716e46511E56FE07b885fBdD70119f768, which he alleged followed a pattern consistent with law enforcement seizures. ZachXBT linked this on-chain activity to Danish Zulfiqar (aka Danny Khan), a British national who ZachXBT alleged was involved in both the August 2023 Kroll SIM swap and the August 2024 $243–$263 million Genesis creditor theft. ZachXBT posted publicly in January 2025: 'Never forget Kroll had an employee SIM swapped in Aug 2023 resulting in breaches for Blockfi, FTX, Genesis creditors which lead to 8-9 figs stolen by cybercriminals via email phishing campaigns and social engineering scams. Idk how your company has not been sued to oblivion.' ZachXBT's on-chain analysis is classified as Tier 2 source material; the wallet attributions and total loss figures have not been formally confirmed by law enforcement filings naming Kroll as a nexus.","heading":"ZachXBT On-Chain Investigation","sources":[],"severity":"medium"},{"content":"Danish Zulfiqar (also known as 'Danny' and 'Meech') and Mustafa Ibrahim (also known as 'Krust'), both British nationals, were arrested in Dubai on charges related to the Social Engineering (SE) Enterprise. Their arrests were announced by IRS Criminal Investigation and the U.S. Attorney's Office for the District of Columbia. The IRS-CI press release of December 2025 confirmed that a Second Superseding Indictment named Zulfiqar as a participant in the August 18, 2024 theft of over 4,100 Bitcoin (then valued at approximately $263 million, rising to approximately $368 million at the time of reporting) from a Genesis creditor located in Washington, D.C. The theft was carried out through social engineering: conspirators impersonated Google and Gemini support staff, convinced the victim to disable two-factor authentication, and used the AnyDesk remote access tool to extract Bitcoin private keys. The broader criminal enterprise, described by the DOJ as the 'SE Enterprise,' operated from at least October 2023 through May 2025 and is charged under RICO conspiracy statutes. Other co-defendants include Malone Lam (arrested Miami, September 2024), Veer Chetal (arrested, pleaded guilty), Jeandiel Serrano, and others. ZachXBT alleged, though no DOJ filing independently confirms, that Zulfiqar's involvement predated the SE Enterprise and included the August 2023 Kroll SIM swap. The Dubai Police had not publicly confirmed the arrest as of December 2025 reporting.","heading":"Dubai Arrest and RICO Indictment","sources":[],"severity":"medium"},{"content":"On August 20, 2025, Hall Attorneys filed a class-action lawsuit against Kroll Restructuring Administration LLC in the U.S. District Court for the Western District of Texas on behalf of lead plaintiff Jacob Kevyn Repko and a proposed class encompassing FTX, BlockFi, and Genesis claimants. The complaint alleges that Kroll's negligence in cybersecurity protocols — specifically its reliance on email as the sole channel for claimant communications — created a single point of failure that attackers exploited. The lawsuit seeks systemic changes to Kroll's claims administration practices, including multi-channel communications (email and physical mail), mandatory cure windows for status changes, and manual KYC-gating alternatives. Repko allegedly lost 1.9 ETH in July 2025 due to a phishing attack that exploited data exposed in the 2023 breach. Bloomberg Law reported that Kroll subsequently moved to have the suit tossed, arbitrated, or transferred. As of the filing date, RICO claims do not appear to have been included in this civil action. Maximum statutory damages under California privacy law for class members were cited at up to $750 per eligible claimant.","heading":"Class Action Lawsuit Against Kroll","sources":[],"severity":"medium"},{"content":"T-Mobile's role in the Kroll breach has been documented but not adjudicated. Kroll's own disclosure explicitly stated that T-Mobile transferred the employee's number 'without any authority from or contact with Kroll or its employees.' SIM swapping against T-Mobile was documented as a widespread and inexpensive exploit during this period: Krebs on Security reported that over 100 SIM-swap incidents targeting T-Mobile employees occurred in the second half of 2022 alone, with the average price to purchase such an attack on dark markets being approximately $1,500. No separate lawsuit against T-Mobile specifically for the Kroll breach has been identified in publicly available sources as of this report's publication date.","heading":"T-Mobile Liability and Systemic Risk","sources":[],"severity":"medium"}],"timeline":[{"date":"2022-11-11","event":"FTX files for bankruptcy; Kroll is subsequently appointed as court-authorized claims and noticing agent for FTX Trading Ltd.","source":"","source_url":"https://restructuring.ra.kroll.com/ftx/"},{"date":"2023-08-19","event":"Threat actor SIM-swaps a Kroll employee's T-Mobile number without authorization, gaining access to Kroll's cloud systems and PII files for FTX, BlockFi, and Genesis claimants.","source":"","source_url":"https://krebsonsecurity.com/2023/08/kroll-employee-sim-swapped-for-crypto-investor-data/"},{"date":"2023-08-25","event":"Kroll publicly discloses the data breach. FTX, BlockFi, and Genesis notify affected claimants. Phishing emails spoofing FTX begin circulating the same morning.","source":"","source_url":"https://www.bleepingcomputer.com/news/security/kroll-data-breach-exposes-info-of-ftx-blockfi-genesis-creditors/"},{"date":"2024-01-24","event":"U.S. Attorney's Office unseals indictment against Robert Powell, Carter Rohn, and Emily Hernandez — the 'Powell SIM Swapping Crew' — for a separate series of SIM swap attacks including one tied to $400M+ stolen from FTX on the day of its bankruptcy filing (November 2022).","source":"","source_url":"https://krebsonsecurity.com/2024/02/arrests-in-400m-sim-swap-tied-to-heist-at-ftx/"},{"date":"2024-08-18","event":"Alleged SE Enterprise members, including Malone Lam and Danish Zulfiqar, steal over 4,100 Bitcoin (approximately $243–$263 million) from a Genesis creditor in Washington, D.C. via social engineering.","source":"","source_url":"https://www.irs.gov/compliance/criminal-investigation/guilty-plea-and-superseding-indictment-announced-in-social-engineering-scheme-that-stole-263-million-in-cryptocurrency"},{"date":"2024-09-18","event":"Malone Lam and Jeandiel Serrano arrested in Miami; DOJ unseals initial indictment for the $243 million Genesis creditor theft.","source":"","source_url":"https://www.coindesk.com/business/2024/09/19/police-arrests-two-people-related-to-243m-crypto-heist-targeting-genesis-creditor"},{"date":"2025-01-07","event":"ZachXBT publicly criticizes Kroll on X, stating the August 2023 SIM swap resulted in '8-9 figs stolen' via phishing and social engineering against FTX, BlockFi, and Genesis claimants.","source":"","source_url":"https://crypto.news/zachxbt-tracks-3670-eth-as-danny-khan-arrest-ties-to-genesis-kroll-hacks/"},{"date":"2025-12-03","event":"Nicholas Dellecave arrested in Miami on RICO charges related to the SE Enterprise.","source":"","source_url":"https://www.irs.gov/compliance/criminal-investigation/guilty-plea-and-superseding-indictment-announced-in-social-engineering-scheme-that-stole-263-million-in-cryptocurrency"},{"date":"2025-12-08","event":"Evan Tangeman pleads guilty to RICO conspiracy for laundering at least $25 million in stolen cryptocurrency for the SE Enterprise.","source":"","source_url":"https://www.irs.gov/compliance/criminal-investigation/cryptocurrency-money-launderer-pleads-guilty-to-rico-conspiracy-in-scheme-that-stole-263-million-in-crypto"},{"date":"2025-12-10","event":"Danish Zulfiqar (aka 'Danny'/'Meech') and Mustafa Ibrahim reported arrested in Dubai; ZachXBT tracks approximately 3,670 ETH consolidated to a wallet in a pattern consistent with law enforcement seizure. Approximately $18.58 million in crypto allegedly seized.","source":"","source_url":"https://crypto.news/zachxbt-tracks-3670-eth-as-danny-khan-arrest-ties-to-genesis-kroll-hacks/"},{"date":"2025-08-20","event":"Class-action lawsuit filed against Kroll Restructuring Administration LLC in the U.S. District Court for the Western District of Texas by Hall Attorneys on behalf of lead plaintiff Jacob Kevyn Repko.","source":"","source_url":"https://news.bloomberglaw.com/bankruptcy-law/kroll-hit-with-class-suit-over-2023-ftx-bankruptcy-data-breach"}],"sources_used":[],"source_tags":["zachxbt"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet","created_at":"2026-05-04T16:05:02.051909+00:00","updated_at":"2026-08-29T01:35:54.714+00:00"}}