On-chain investigator ZachXBT says a $40 million-plus theft from US authorities crypto seizure wallets might hint again to John Daghita, an alleged menace actor who goes by “Lick,” and a contractor relationship tied to Daghita’s household.
The $40 Million+ Govt Crypto Pockets Theft
In a Jan. 25 publish, ZachXBT pointed to Command Companies & Help (CMDSS), describing it as a agency with “an lively IT authorities contract in Virginia,” and alleging it was “awarded a contract to help the USMS in managing/disposing of seized/forfeited crypto belongings.” ZachXBT added: “It nonetheless stays unclear at this level how John obtained entry from his dad.”
In case you’re curious how John Daghita (Lick) was capable of steal $40M+ from US authorities seizure addresses.
John’s dad owns CMDSS, which presently has an lively IT authorities contract in Virginia.
CMMDS was awarded a contract to help the USMS in managing/disposing of… https://t.co/lzR2a1aidA pic.twitter.com/PV0IkSuhVy
— ZachXBT (@zachxbt) January 25, 2026
The allegation lands in opposition to a backdrop of earlier tracing work revealed Jan. 23, the place ZachXBT linked pockets exercise and recorded chats to the identical persona. “Meet the menace actor John (Lick), who was caught flexing $23M in a pockets handle straight tied to $90M+ in suspected thefts from the US Authorities in 2024 and a number of different unidentified victims from Nov 2025 to Dec 2025,” ZachXBT wrote.
ZachXBT’s thread facilities on a dispute in a Telegram group chat between “John” and one other menace actor, Dritan Kapplani Jr., in what the neighborhood calls “band for band (b4b)”, an on-the-spot contest to show who controls extra funds. ZachXBT stated the interplay was “absolutely recorded,” and claims the footage contains screen-shared pockets balances and contemporaneous transfers that assist set up management.
In response to the thread, the recording exhibits John screen-sharing an Exodus pockets displaying a Tron handle holding $2.3 million. In a second section, ZachXBT stated “one other $6.7M value of ETH” moved into an Ethereum handle whereas the argument continued.
3/ Partially 1 of the recording Dritan mocks John nonetheless John screenshares Exodus Pockets which exhibits the Tron handle beneath with $2.3M:TMrWCLMS3ibDbKLcnNYhLggohRuLUSoHJg pic.twitter.com/jvcjIVEpaE
— ZachXBT (@zachxbt) January 23, 2026
ZachXBT framed the important thing evidentiary level as possession continuity throughout addresses: “The recording captures that John clearly controls each addresses. Further addresses can doubtless be discovered within the recordings. I then started tracing backwards to confirm the supply of funds.”
That tracing, ZachXBT stated, connects the cluster to a March 2024 switch of $24.9 million from a US authorities handle tied to the Bitfinex crypto hack seizure. He additionally claimed $18.5 million “presently sits” at a cited handle.
Past that 2024 linkage, ZachXBT asserted the first handle he tracked was tied to “$63M+ inflows from suspected victims and authorities seizure addresses in This autumn 2025,” itemizing a number of transactions and chains, and individually flagged a further 4.17K ETH ($12.4 million) circulate from MEXC into the identical cluster.
The Jan. 25 publish makes an attempt to elucidate a possible entry path: if CMDSS was concerned in US Marshals Service crypto asset administration, the query turns into whether or not contractor-side programs, credentials, or processes supplied a gap, deliberately or in any other case. ZachXBT pressured that the precise mechanism stays unknown.
Shortly after the publish, ZachXBT stated CMDSS’s X account, web site, and LinkedIn “have been all simply deactivated,” and claimed Daghita “started trolling once more on Telegram.”
On X, the claims drew sharp reactions from distinguished Bitcoin commentators. Nakamoto Inc. CEO David Bailey wrote: “The son of the CEO of the corporate employed by the US Marshalls to safeguard the nation’s Bitcoin, stole $40m from it and now seems to be operating. Treasury should safe the non-public keys from the Justice Division ASAP earlier than extra is stolen.”
Distinguished Bitcoin advocate and co-founder of the Satoshi Nakamoto Institute Pierre Rochard framed the state of affairs in national-security phrases, posting, “This can be a nationwide safety disaster,” and urging Congress to move the BITCOIN Act.
At press time, Bitcoin traded at $87,847.
Featured picture created with DALL.E, chart from TradingView.com
Editorial Course of for bitcoinist is centered on delivering totally researched, correct, and unbiased content material. We uphold strict sourcing requirements, and every web page undergoes diligent overview by our workforce of prime know-how consultants and seasoned editors. This course of ensures the integrity, relevance, and worth of our content material for our readers.
