Kroll
Auto-generated score, not yet verified against the scoring model. Under review — treat as indicative, not a verdict.
anchored·4Yfini…ogDpSummary
Kroll Restructuring Administration LLC served as the court-appointed claims and noticing agent for the FTX, BlockFi, and Genesis bankruptcy proceedings. On August 19, 2023, a threat actor executed a SIM swap attack against a Kroll employee's T-Mobile account, gaining unauthorized access to files containing the personal data of tens of thousands of crypto bankruptcy claimants. The exposed data was subsequently exploited in large-scale phishing and social engineering campaigns, with blockchain investigator ZachXBT estimating total losses attributable to the breach at eight to nine figures, and at least one alleged perpetrator — Danish Zulfiqar, also known as 'Danny' — was arrested in Dubai in late 2025 on RICO charges related to a broader $263 million social engineering conspiracy.
Connected Entities
1 entities- + 1 more
Timeline(11 events)
11 November 2022
FTX files for bankruptcy; Kroll is subsequently appointed as court-authorized claims and noticing agent for FTX Trading Ltd.
19 August 2023
Threat actor SIM-swaps a Kroll employee's T-Mobile number without authorization, gaining access to Kroll's cloud systems and PII files for FTX, BlockFi, and Genesis claimants.
25 August 2023
Kroll publicly discloses the data breach. FTX, BlockFi, and Genesis notify affected claimants. Phishing emails spoofing FTX begin circulating the same morning.
24 January 2024
U.S. Attorney's Office unseals indictment against Robert Powell, Carter Rohn, and Emily Hernandez — the 'Powell SIM Swapping Crew' — for a separate series of SIM swap attacks including one tied to $400M+ stolen from FTX on the day of its bankruptcy filing (November 2022).
18 August 2024
Alleged SE Enterprise members, including Malone Lam and Danish Zulfiqar, steal over 4,100 Bitcoin (approximately $243–$263 million) from a Genesis creditor in Washington, D.C. via social engineering.
18 September 2024
Malone Lam and Jeandiel Serrano arrested in Miami; DOJ unseals initial indictment for the $243 million Genesis creditor theft.
7 January 2025
ZachXBT publicly criticizes Kroll on X, stating the August 2023 SIM swap resulted in '8-9 figs stolen' via phishing and social engineering against FTX, BlockFi, and Genesis claimants.
8 December 2025
Evan Tangeman pleads guilty to RICO conspiracy for laundering at least $25 million in stolen cryptocurrency for the SE Enterprise.
Decision Log
- hash: 13ajenv9oCnxvt3gPVfqUshFgjMQZvk7b46jTiSudDJw
This investigation is cryptographically anchored to the Solana blockchain (1 event).
model: claude-sonnet
generated: 5/4/2026, 4:05:02 PM
last updated: 8/29/2026, 1:35:54 AM
avoid.net — verified advice for a post-truth world