Blockchain investigator ZachXBT alleges an insider tied to a U.S. Marshals Service (USMS) contractor siphoned more than $40 million from U.S. government-controlled wallets holding seized digital assets.
What ZachXBT is alleging
ZachXBT says the suspected thief is John Daghita, who used the online handles “John” or “Lick.”
He further alleges Daghita is the son of Dean Daghita, president of Command Services & Support (CMDSS), a Virginia-based firm that received a USMS contract in October 2024 to help manage and dispose of certain “Class 2-4” seized assets.
The allegations have not been adjudicated in court, and no official charges have been announced.
How the wallets were linked
ZachXBT’s claims build on a leaked recording from a private Telegram dispute in which the suspected actor screen-shared an Exodus wallet and appeared to move funds in real time.
ZachXBT wrote:
“The claim builds on ZachXBT’s earlier investigation linking an individual known as ‘John’ or ‘Lick’ to over $90 million in suspected stolen crypto, including funds tied to a Bitfinex seizure wallet.”
Tracing activity backward, ZachXBT said one wallet received $24.9 million from a U.S. government address in March 2024 tied to assets seized from the 2016 Bitfinex hack.
He has also said roughly $20 million was drained from government-controlled wallets in October 2024, with most returned within 24 hours but around $700,000 not recovered after being routed through instant exchanges.
Custody questions for U.S. bitcoin
The episode has renewed scrutiny of how the U.S. inventories and safeguards seized bitcoin held by the government.
Bitbo’s tracker lists the U.S. government’s bitcoin holdings among the largest known state-linked treasuries.
