A British hacker linked to the theft of $243 million from lender Genesis may have been detained by law enforcement in Dubai, according to blockchain investigator ZachXBT.
The researcher reported on his Telegram channel that the suspect is Danny Mitch, who also goes by Danish Zulfiqar (Khan). He added that cryptocurrency belonging to the suspect may have been seized.
ZachXBT says approximately $18.58 million in assets can be traced to an Ethereum address associated with the individual. He notes that the wallet’s recent consolidation activity resembles patterns seen when authorities seize crypto funds.
The researcher also claims that Zulfiqar was “last seen in Dubai” and that people who previously communicated with him have stopped responding.
However, local Dubai media and official channels have not reported any arrests, searches, or seizures connected to this case.
The Genesis theft occurred in August 2024 and ranks among the largest known attacks against an individual. According to ZachXBT, the attackers posed as Google support staff and persuaded the victim to reset two-factor authentication on their Gemini account.
Once inside, the attackers drained the account, withdrawing 4,064 BTC through multiple crypto services.
ZachXBT previously tied the hack to three individuals known as Greavys, Wiz, and Box — later identified as Malone Lam, Vir Chetal, and Jandiel Serrano. His findings were forwarded to law enforcement, leading to multiple U.S. criminal cases linked to similar schemes.
The U.S. Department of Justice has charged the group with fraud and extortion exceeding $260 million, detailing operations involving SIM swapping, social engineering, and physical access, with proceeds spent on luxury travel, cars, and entertainment.
In a related matter, in May 2025, Genesis filed two lawsuits against Digital Currency Group (DCG) and its founder Barry Silbert, seeking $3.3 billion in damages.
As authorities investigate the latest developments around Zulfiqar, the crypto community awaits confirmation from Dubai officials on whether a major break in the case has occurred.

Legal experts are concerned that transforming ESMA into the “European SEC” may hinder the licensing of crypto and fintech in the region. The European Commission’s proposal to expand the powers of the European Securities and Markets Authority (ESMA) is raising concerns about the centralization of the bloc’s licensing regime, despite signaling deeper institutional ambitions for its capital markets structure.On Thursday, the Commission published a package proposing to “direct supervisory competences” for key pieces of market infrastructure, including crypto-asset service providers (CASPs), trading venues and central counterparties to ESMA, Cointelegraph reported.Concerningly, the ESMA’s jurisdiction would extend to both the supervision and licensing of all European crypto and financial technology (fintech) firms, potentially leading to slower licensing regimes and hindering startup development, according to Faustine Fleuret, head of public affairs at decentralized lending protocol Morpho.Read more

