ZachXBT: Dubai Crypto Crime Crackdown Targets Suspects Tied To $19M Fraud And Data Breach Schemes
In Brief
ZachXBT disputes claims that Dubai detainees were innocent crypto entrepreneurs, linking them to major fraud, data breach and social engineering schemes as authorities intensify enforcement.
On-chain investigator ZachXBT has pushed back against media reports framing recent detentions in Dubai as a crackdown on innocent crypto entrepreneurs. According to ZachXBT, the individuals in question were in fact perpetrators behind a network of sophisticated social engineering scams and data extortion schemes, with total damages running into the hundreds of millions of dollars.
Among the detained is Danish Zulfiqar Khan, known online as “Danny” or “Meech.” ZachXBT flagged Zulfiqar’s suspected arrest in a December 5 Telegram post, noting that wallets previously linked to the alleged hacker had funneled funds into a single Ethereum address — a pattern commonly associated with law enforcement seizures — and that people who had communicated with him had stopped responding. Zulfiqar is connected to the $243 million Genesis creditor theft, which was carried out by a broader social engineering enterprise.
According to a U.S. Department of Justice superseding indictment, the enterprise operated from at least October 2023 through May 2025, growing out of relationships formed on online gaming platforms and spanning members across California, Connecticut, New York, Florida, and abroad. Zulfiqar is also linked to the August 2023 Kroll SIM swap incident, which exposed personal data of creditors tied to BlockFi, Genesis, and FTX, and later enabled more than $300 million in follow-up phishing and impersonation thefts.
The Kroll breach involved attackers exploiting a T-Mobile account belonging to a Kroll employee, using SIM-swapping to hijack the phone number and access files containing personal data of bankruptcy claimants across FTX, BlockFi, and Genesis. That stolen data became the foundation for waves of targeted fraud against vulnerable creditors.
Ryan Pepper is implicated in data breaches and extortion related to Fractal ID, a crypto KYC provider. In July 2024, Fractal ID detected a malicious attack in which an operator account with admin rights was compromised, enabling attackers to bypass internal privacy systems and exfiltrate data affecting approximately 0.5% of its user base. A subsequent ransomware claim in October 2024 alleged that over 10 gigabytes of data, potentially covering 300,000 users, had been stolen.
Cameron Cureton, meanwhile, is linked to the Coinbase social engineering network. That operation involved criminals bribing and recruiting overseas support agents to steal Coinbase customer data, which was then used to impersonate the platform and manipulate users into transferring funds.
Dubai police have seized approximately $18.9 million in assets connected to the detainees. ZachXBT has been clear: media portrayals of these individuals as innocent victims of authoritarian overreach are factually wrong.
Dubai and Global Crypto Fraud
The arrests are part of a broader and escalating enforcement posture by Dubai authorities against global crypto crime. Most recently, an international operation spearheaded by the Dubai Police under the UAE Ministry of Interior — in coordination with the FBI and China’s Ministry of Public Security — resulted in at least 276 arrests and the dismantlement of at least nine crypto scam centers that had been targeting Americans through fraudulent investment schemes.
On the regulatory side, in February 2026, VARA issued a circular to all licensed virtual asset service providers in Dubai setting out strict expectations for implementing the UAE Virtual Asset Travel Rule, prohibiting transfers to unregulated counterparties and requiring rigorous counterparty due diligence. Between August 2024 and August 2025, VARA issued enforcement notices against 36 firms for violations including unlicensed virtual asset activities and unauthorized marketing.
Taken together, these actions signal that Dubai has moved firmly away from its earlier reputation as a loose jurisdiction for crypto operators — and is now one of the more active enforcement hubs for cross-border digital asset fraud.
Disclaimer
In line with the Trust Project guidelines, please note that the information provided on this page is not intended to be and should not be interpreted as legal, tax, investment, financial, or any other form of advice. It is important to only invest what you can afford to lose and to seek independent financial advice if you have any doubts. For further information, we suggest referring to the terms and conditions as well as the help and support pages provided by the issuer or advertiser. MetaversePost is committed to accurate, unbiased reporting, but market conditions are subject to change without notice.
About The Author
Alisa, a dedicated journalist at the MPost, specializes in crypto, AI, investments, and the expansive realm of Web3. With a keen eye for emerging trends and technologies, she delivers comprehensive coverage to inform and engage readers in the ever-evolving landscape of digital finance.
More articles
Alisa, a dedicated journalist at the MPost, specializes in crypto, AI, investments, and the expansive realm of Web3. With a keen eye for emerging trends and technologies, she delivers comprehensive coverage to inform and engage readers in the ever-evolving landscape of digital finance.
