Verify a decision

{"actor":"system:backfill","investigation_id":"b4b41e0c-557d-48ce-98d9-90b54943f551","kind":"publish","page_slug":"danish-zulfiqar","published_at":"2026-10-15T20:09:16.391Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Danish Zulfiqar","sections":[{"content":"On or around August 19, 2024, approximately 4,064-4,100 bitcoin (reported at the time as worth between $230 million and $263 million) was allegedly stolen from a single Genesis creditor whose assets were held through Gemini. According to reporting on the scheme, attackers posed as Google and Gemini support staff, convinced the victim to reset two-factor authentication, used remote-access software to extract private keys, and then moved the bitcoin through exchanges and swap services. On-chain investigator ZachXBT publicized the case in September 2024 and initially tied it to online aliases later alleged to be Malone Lam, Veer Chetal, and Jeandiel Serrano. Danish Zulfiqar was not among the original defendants charged in September 2024, but was alleged in later reporting to be one of the threat actors behind the broader scheme, operating under the handle \"Danny\" or \"Meech.\"","heading":"Alleged role in the Genesis creditor theft (August 2024)","severity":"critical","sources":[{"credibility":2,"name":"ZachXBT: British Hacker Linked to $243M Genesis Theft Likely Nabbed in Dubai (Yahoo/AFP)","type":"news_article","url":"https://www.yahoo.com/news/articles/zachxbt-british-hacker-linked-243m-182212083.html"},{"credibility":2,"name":"The Block: Crypto sleuth ZachXBT claims British threat actor tied to $243 million Genesis creditor theft 'likely arrested'","type":"news_article","url":"https://www.theblock.co/post/381481/crypto-sleuth-zachxbt-claims-british-threat-actor-tied-to-243-million-genesis-creditor-theft-likely-arrested"},{"credibility":2,"name":"DOJ: Federal prosecutors charge 12 individuals in $263 million crypto scheme targeting early Genesis investor (The Block coverage)","type":"news_article","url":"https://www.theblock.co/post/354633/federal-prosecutors-charge-12-more-in-alleged-263-million-usd-crypto-racketeering-ring"}]},{"content":"Reporting on a second superseding indictment in the U.S. District Court for the District of Columbia describes three additional defendants added to the long-running racketeering (RICO) case over the $263 million social-engineering scheme: Nicholas Dellecave, Mustafa Ibrahim (alleged alias \"Krust\"), and Danish Zulfiqar. This addition reportedly brought the total number of individuals charged in the case to 17. Dellecave was reported arrested in Miami on or about December 3, 2025. Zulfiqar and Ibrahim were reported to have been arrested in the UAE around the same period, according to secondary crypto-industry reporting; this account could not be independently verified against the primary DOJ press release or court docket during this investigation, as direct access to justice.gov was blocked. The underlying racketeering enterprise is alleged to have run from no later than October 2023 through at least May 2025, using stolen personal-data databases, impersonation calls, SIM swaps, and residential burglaries to steal hardware wallets, with proceeds allegedly laundered into cash, rental properties, and luxury goods.","heading":"Second superseding federal indictment (December 2025)","severity":"critical","sources":[{"credibility":2,"name":"Whale Alert: 22-year-old pleads guilty in multi-state scheme that stole $263M / 4,100 BTC — Danish Zulfiqar aka Danny Khan tied to Genesis, Kroll hacks","type":"news_article","url":"https://whale-alert.io/stories/ed691817672c/22-year-old-pleads-guilty-in-multi-state-scheme-that-stole-263M-4100-BTC-Danish-Zulfiqar-aka-Danny-Khan-tied-to-Genesis-Kroll-hacks-and-3670-ETH-tracked-sentencing-set-for-April-24-2026"},{"credibility":1,"name":"DOJ: Additional 12 defendants charged in RICO conspiracy for over $263 million cryptocurrency thefts","type":"regulatory","url":"https://www.justice.gov/usao-dc/pr/additional-12-defendants-charged-rico-conspiracy-over-263-million-cryptocurrency-thefts"},{"credibility":1,"name":"DOJ: Guilty plea and superseding indictment announced in social engineering scheme that stole $263 million in cryptocurrency","type":"regulatory","url":"https://www.justice.gov/usao-dc/pr/guilty-plea-and-superseding-indictment-announced-social-engineering-scheme-stole-263"}]},{"content":"ZachXBT has alleged that Zulfiqar was connected to an August 2023 SIM-swap incident affecting Kroll, the bankruptcy claims agent for BlockFi, Genesis, and FTX, which exposed creditor personal data. Reporting states this breach has been linked by investigators to more than $300 million in subsequent social-engineering thefts targeting individuals whose data was exposed. This claim originates from ZachXBT's independent on-chain investigation work and has not been confirmed in a charging document reviewed for this report; it should be treated as alleged.","heading":"Alleged link to 2023 Kroll data breach","severity":"high","sources":[{"credibility":2,"name":"ZachXBT: British Hacker Linked to $243M Genesis Theft Likely Nabbed in Dubai (Yahoo/AFP)","type":"news_article","url":"https://www.yahoo.com/news/articles/zachxbt-british-hacker-linked-243m-182212083.html"},{"credibility":2,"name":"Coinotag: Ethereum-linked addresses tied to Danny/Meech arrest as $243M Genesis theft assets seized, ZachXBT reveals","type":"news_article","url":"https://en.coinotag.com/breakingnews/ethereum-linked-addresses-tied-to-danny-meech-arrest-as-243m-genesis-theft-assets-seized-zachxbt-reveals"}]},{"content":"On December 5, 2025, ZachXBT posted on Telegram that a suspect he identified as \"Danny / Meech aka Danish Zulfiqar (Khan)\" appeared to have been arrested by law enforcement, alleging a villa raid in Dubai and that associates had gone silent. He pointed to approximately $18.58 million in cryptocurrency consolidated at a single Ethereum address (reported beginning \"0xb37d\"), stating the consolidation pattern resembled prior law-enforcement seizures. At the time of that reporting, neither Dubai Police nor UAE regulators had issued a public statement, and The Block reported it found no local media confirming a raid, arrest, or seizure. This claim should be treated as alleged and sourced to a single investigator pending the official confirmation described below.","heading":"Alleged December 2025 Dubai detention and on-chain asset movements","severity":"high","sources":[{"credibility":2,"name":"The Block: Crypto sleuth ZachXBT claims British threat actor tied to $243 million Genesis creditor theft 'likely arrested'","type":"news_article","url":"https://www.theblock.co/post/381481/crypto-sleuth-zachxbt-claims-british-threat-actor-tied-to-243-million-genesis-creditor-theft-likely-arrested"},{"credibility":2,"name":"ZachXBT: British Hacker Linked to $243M Genesis Theft Likely Nabbed in Dubai (Yahoo/AFP)","type":"news_article","url":"https://www.yahoo.com/news/articles/zachxbt-british-hacker-linked-243m-182212083.html"},{"credibility":2,"name":"Coinotag: Ethereum-linked addresses tied to Danny/Meech arrest as $243M Genesis theft assets seized, ZachXBT reveals","type":"news_article","url":"https://en.coinotag.com/breakingnews/ethereum-linked-addresses-tied-to-danny-meech-arrest-as-243m-genesis-theft-assets-seized-zachxbt-reveals"}]},{"content":"According to on-chain investigator ZachXBT's Telegram channel, Sharjah Police (UAE) published a press release on or around October 15, 2026, said to confirm legal action resulting in more than $54 million in seized assets and 33 arrests of alleged cybercriminals, accompanied by a video reportedly naming threat actors Danish Zulfiqar (\"Danny\"), Ibrahim Mustafa (\"Krust\"), and Cameron Cureton (\"CX\"). This would represent the first official UAE confirmation of action against Zulfiqar following the unconfirmed December 2025 reports of his detention. This investigation could not independently retrieve or verify the content of the Sharjah Police press release or accompanying video — the X (Twitter) post could not be accessed directly, and no independent news coverage of this specific announcement was found through web search at the time of writing, likely reflecting its recency. Cameron Cureton does not appear by that name in any U.S. federal indictment reporting reviewed for this report. This entire section rests on a single secondhand account (ZachXBT's summary of a police release) and should be treated as low-to-moderate confidence pending independent verification or an English-language news report confirming the press release's contents.","heading":"Alleged UAE official confirmation (Sharjah Police, October 2026)","severity":"critical","sources":[{"credibility":2,"name":"ZachXBT on Telegram (t.me/zachxbt/366)","type":"social_media","url":"https://t.me/zachxbt/366"},{"credibility":2,"name":"Sharjah Police (SHJ Police) press release on X","type":"official","url":"https://x.com/shjpolice/status/2110655954417258752"}]}],"sources_used":[{"credibility":2,"name":"ZachXBT on Telegram (t.me/zachxbt/366)","type":"social_media","url":"https://t.me/zachxbt/366"},{"credibility":2,"name":"Sharjah Police (SHJ Police) press release on X","type":"official","url":"https://x.com/shjpolice/status/2110655954417258752"},{"credibility":2,"name":"ZachXBT: British Hacker Linked to $243M Genesis Theft Likely Nabbed in Dubai (Yahoo/AFP)","type":"news_article","url":"https://www.yahoo.com/news/articles/zachxbt-british-hacker-linked-243m-182212083.html"},{"credibility":2,"name":"The Block: Crypto sleuth ZachXBT claims British threat actor tied to $243 million Genesis creditor theft 'likely arrested'","type":"news_article","url":"https://www.theblock.co/post/381481/crypto-sleuth-zachxbt-claims-british-threat-actor-tied-to-243-million-genesis-creditor-theft-likely-arrested"},{"credibility":2,"name":"Whale Alert: 22-year-old pleads guilty in multi-state scheme that stole $263M / 4,100 BTC — Danish Zulfiqar aka Danny Khan","type":"news_article","url":"https://whale-alert.io/stories/ed691817672c/22-year-old-pleads-guilty-in-multi-state-scheme-that-stole-263M-4100-BTC-Danish-Zulfiqar-aka-Danny-Khan-tied-to-Genesis-Kroll-hacks-and-3670-ETH-tracked-sentencing-set-for-April-24-2026"},{"credibility":1,"name":"DOJ: Additional 12 defendants charged in RICO conspiracy for over $263 million cryptocurrency thefts","type":"regulatory","url":"https://www.justice.gov/usao-dc/pr/additional-12-defendants-charged-rico-conspiracy-over-263-million-cryptocurrency-thefts"},{"credibility":1,"name":"DOJ: Guilty plea and superseding indictment announced in social engineering scheme that stole $263 million in cryptocurrency","type":"regulatory","url":"https://www.justice.gov/usao-dc/pr/guilty-plea-and-superseding-indictment-announced-social-engineering-scheme-stole-263"},{"credibility":2,"name":"The Block: Federal prosecutors charge 12 individuals in $263 million crypto scheme targeting early Genesis investor","type":"news_article","url":"https://www.theblock.co/post/354633/federal-prosecutors-charge-12-more-in-alleged-263-million-usd-crypto-racketeering-ring"},{"credibility":2,"name":"Coinotag: Ethereum-linked addresses tied to Danny/Meech arrest as $243M Genesis theft assets seized, ZachXBT reveals","type":"news_article","url":"https://en.coinotag.com/breakingnews/ethereum-linked-addresses-tied-to-danny-meech-arrest-as-243m-genesis-theft-assets-seized-zachxbt-reveals"},{"credibility":2,"name":"CryptoBriefing: First Bitcoin RICO case charges 18 defendants over $263M crypto heist","type":"news_article","url":"https://cryptobriefing.com/first-bitcoin-rico-case-doj/"}],"summary":"Danish Zulfiqar, also known online as \"Danny,\" \"Meech,\" or \"Danny Khan,\" is a British national alleged by U.S. prosecutors and on-chain investigator ZachXBT to be a member of a social-engineering theft ring responsible for stealing roughly $243-263 million in cryptocurrency, including approximately 4,100 bitcoin taken from a Genesis creditor in August 2024. He was named in a second superseding federal indictment in December 2025 alongside co-defendants Nicholas Dellecave and Mustafa Ibrahim ('Krust'), and was reportedly detained in the United Arab Emirates around the same time, with Sharjah police said to have publicly confirmed arrests and asset seizures in October 2026. Much of the public record relies on claims by ZachXBT and secondary crypto-news aggregation rather than directly verified primary documents, so key details carry moderate rather than high confidence.","timeline":[{"date":"2023-08","event":"Alleged SIM-swap data breach at Kroll, the claims agent for BlockFi, Genesis, and FTX bankruptcies, later linked by investigators to Zulfiqar and to subsequent social-engineering thefts.","source":"Yahoo/AFP via ZachXBT","source_url":"https://www.yahoo.com/news/articles/zachxbt-british-hacker-linked-243m-182212083.html"},{"date":"2024-08","date_original":"2024-08-19","event":"Approximately 4,064-4,100 bitcoin (reported at roughly $230-243 million) allegedly stolen from a single Genesis creditor via social engineering; Zulfiqar later alleged to be among the threat actors tied to the scheme.","source":"The Block","source_url":"https://www.theblock.co/post/381481/crypto-sleuth-zachxbt-claims-british-threat-actor-tied-to-243-million-genesis-creditor-theft-likely-arrested"},{"date":"2024-09","event":"DOJ initially charges Malone Lam and Jeandiel Serrano in connection with the theft; broader racketeering indictments follow over subsequent months.","source":"DOJ / The Block","source_url":"https://www.theblock.co/post/354633/federal-prosecutors-charge-12-more-in-alleged-263-million-usd-crypto-racketeering-ring"},{"date":"2025-12","event":"A second superseding indictment reportedly names Nicholas Dellecave, Mustafa Ibrahim, and Danish Zulfiqar as additional defendants in the $263 million RICO conspiracy case.","source":"Whale Alert aggregation of court reporting","source_url":"https://whale-alert.io/stories/ed691817672c/22-year-old-pleads-guilty-in-multi-state-scheme-that-stole-263M-4100-BTC-Danish-Zulfiqar-aka-Danny-Khan-tied-to-Genesis-Kroll-hacks-and-3670-ETH-tracked-sentencing-set-for-April-24-2026"},{"date":"2025-12-05","date_evidence":"the article is dated Friday, December 5, 2025","event":"ZachXBT states on Telegram that Danish Zulfiqar ('Danny'/'Meech') 'appears to have likely been arrested' in Dubai with roughly $18.58 million in crypto assets allegedly seized; no official UAE confirmation reported at the time.","source":"Yahoo/AFP; The Block","source_url":"https://www.yahoo.com/news/articles/zachxbt-british-hacker-linked-243m-182212083.html"},{"date":"2026-04","date_original":"2026-04-24","event":"Scheduled sentencing date for co-defendant Evan Tangeman, who pleaded guilty to a RICO conspiracy charge in the same case (unrelated directly to Zulfiqar's own case status).","source":"Whale Alert","source_url":"https://whale-alert.io/stories/ed691817672c/22-year-old-pleads-guilty-in-multi-state-scheme-that-stole-263M-4100-BTC-Danish-Zulfiqar-aka-Danny-Khan-tied-to-Genesis-Kroll-hacks-and-3670-ETH-tracked-sentencing-set-for-April-24-2026"},{"date":"2026-10","date_original":"2026-10-15","event":"ZachXBT reports that Sharjah (UAE) police published a press release and video said to confirm $54M+ seized and 33 arrests of cybercriminals, naming Danish Zulfiqar, Ibrahim Mustafa, and Cameron Cureton.","source":"ZachXBT on Telegram","source_url":"https://t.me/zachxbt/366"}]},"v":1}