BREAKING: ZachXBT Unravels 3,670 ETH Trail Leading to Danny Khan’s Dubai Arrest, Kroll Hacked!

Oh, what a tangled web we weave-especially when you’re a cybercriminal. ZachXBT, the blockchain Sherlock Holmes, has traced a grand total of 3,670 ETH straight into the hands of one Danny Khan, a suspect with a track record as twisted as his aliases. What do we know so far? Well, it seems Khan (aka Danish Zulfiqar) found himself a new vacation spot in Dubai, where he promptly got arrested while the authorities helped themselves to his crypto stash. All that hard-earned Ethereum, gone, just like that.

He couldn’t.

Update: A superseding indictment from just a few hours ago confirmed my analysis that Danny / Danish Zulfiqar (Khan) was arrested in Dubai.

Seizure address
0xb37d617716e46511E56FE07b885fBdD70119f768

– ZachXBT (@zachxbt) December 9, 2025

To add some extra drama, the on-chain sleuth reported via Telegram (naturally) that these funds were transferred into the wallet 0xb37d6…9f768, and then, like a regular Monday morning, the money was traced back to Khan. ZachXBT noted that this wallet had “a similar pattern to other law enforcement seizures”-in case you were wondering, that’s not a compliment, Danny.

ZachXBT Tracks Scammers from Lagos to Dubai

And where did this cyber criminal mastermind last appear? Oh yes, Dubai. According to ZachXBT’s highly dramatic (and possibly slightly smug) report, Dubai’s authorities raided a villa and arrested not just Khan but a few of his unlucky companions. Naturally, no one’s been answering their phones lately. Imagine that!

Now, just in case you were thinking, “But maybe it’s a misunderstanding!”-a superseding indictment, hot off the press, confirms that yes, it really was Khan (or Danish Zulfiqar, if you’re feeling fancy) who was arrested. All that illicit crypto laundering was finally catching up with him.

Our dear investigator, ZachXBT, had been keeping an eye on Khan since 2024, linking him to a little theft from a Genesis creditor that happened way back in August of that year. No big deal, right? Except the theft was the result of an elaborate social engineering plot involving fake Google and Gemini support staff, a quick round of AnyDesk remote access, and a very sad victim who was too trusting of the scammers.

When the funds were transferred, they allegedly ended up in the hands of the conspirators, who laundered them through more than 15 exchanges, swapping them between Bitcoin, Litecoin, Ethereum, and Monero. Because, why not? They had the whole crypto buffet at their disposal. 🍽️

But wait, there’s more! ZachXBT also links Khan to the infamous August 2023 Kroll SIM swap incident, which exposed sensitive data from BlockFi, Genesis, and FTX creditors. This breach was an absolute dumpster fire for those affected, and Kroll confirmed it was all thanks to a T-Mobile employee’s account getting hijacked through a SIM swap. Who said cybercrime wasn’t glamorous? 💀💻

While authorities haven’t made an official statement on Khan’s arrest just yet, all signs point to the fact that this case is far from over. Maybe next time, Danny, you should pick a less conspicuous holiday destination. 😬

Read More

2025-12-10 13:51