U.S. Marshals investigate claims that son of government contractor stole $40 million of seized crypto
The threat actor was captured on video flaunting millions in crypto allegedly siphoned from U.S. government seizure addresses, later traced back by ZachXBT.
The U.S. Marshals Service (USMS) is investigating allegations that the son of a Department of Defense and Department of Justice services provider, charged with managing cryptocurrency seized by law enforcement, stole more than $40 million worth of confiscated digital assets.
Blockchain investigator ZachXBT accused John "Lick" Daghita, son of Dean Daghita, president of CMDSS — a firm that says on its website it provides critical services for the Department of Justice and Department of Defense — of stealing the seized digital assets from crypto walltes managed by his father's company.
ZachXBT, who said he reported John to authorities, stated it remains unclear how John Daghita allegedly obtained access to the wallets, including whether that access came through his father.
Brady McCarron, chief of public affairs for the USMS, told CoinDesk that the agency could not comment further on this case because investigations were underway.
“Meet the threat actor John (Lick), who was caught flexing $23M in a wallet address directly tied to $90M+ in suspected thefts from the US Government in 2024 and multiple other unidentified victims from Nov 2025 to Dec 2025,” ZachXBT posted on X last Friday.
ZachXBT identified the individual as John Daghita, claiming CMDSS currently holds an active federal IT contract. The blockchain investigator later said he reported a wallet address holding 12,540 ETH, worth roughly $36.3 million, which he said was controlled by Daghita. ZachXBT added that Daghita sent him 0.6767 ETH, which he said he would forward to a U.S. government seizure address.
“In case you are curious how John Daghita (Lick) was able to steal $40 million plus from U.S. government seizure addresses: John’s dad owns CMDSS, which currently has an active IT government contract in Virginia,” ZachXBT wrote, pointing to a CoinDesk report that CMDSS was awarded a contract to assist the U.S. Marshals Service (USMS) in managing and disposing of seized and forfeited crypto assets.
The Department of Defense, ZachXBT, and CMDSS did not immediately respond to a CoinDesk request for comment.
In February 2025, after the White House announced it was considering a national crypto reserve, a source familiar with the matter told CoinDesk the U.S. Marshals Service did not appear to know how much cryptocurrency it held.
The USMS is tasked with managing assets seized by law enforcement during criminal investigations, including real estate, cash, jewelry, antiques and vehicles.
John Daghita drew attention to himself after becoming embroiled in a recorded argument in a Telegram group chat with another individual. The exchange, known in cybercriminal circles as a “band for band," involved both participants attempting to prove who controlled more cryptocurrency. ZachXBT captured the dispute on video.
“In part 1 of the (video) recording, Dritan (another threat actor) mocks John,” Zach said. “However, John screenshares [a] Exodus Wallet,” showing $2.3 million. In part 2 of the recording, Dritan continued to mock John while another $6.7 million worth of ETH is moved” into a wallet address.
ZachXBT said the full recording shows that Daghita “clearly controls both addresses.” The sleuth then explained he traced the funds to verify their origin, finding that at least $23 million was tied to roughly $90 million in crypto seized by the government in 2024 and 2025.
“Threat actors only continue to showing off stolen funds in leaked recordings rather than simply just staying quiet after an alleged theft from the U.S. government,” criticized Zach, saying they only make it easy for law enforcement to support a case against them.
KuCoin captured a record share of centralised exchange volume in 2025, with more than $1.25tn traded as its volumes grew faster than the wider crypto market.
BitMine, the largest Ethereum treasury firm, makes biggest ether purchase of 2026
The crypto treasury firm added over 40,000 ETH last week and has now staked over 2 million tokens.
Asanat Analysis — Why it matters
This case exemplifies a critical infrastructure vulnerability in U.S. government crypto custody: the concentration of control over $90+ million in seized assets within a single contractor with insufficient access segregation. CMDSS's federal contract to manage USMS crypto holdings created a permissions structure where a contractor's family member could allegedly exploit administrative access—a governance failure that mirrors historical custodial breaches in traditional finance, but with faster asset movement due to blockchain's immutability and borderless settlement.
The incident underscores a broader institutional problem: law enforcement agencies tasked with crypto seizure lack transparent, real-time accounting of holdings. The February 2025 reporting that USMS couldn't quantify its own digital asset inventory suggests the agency was already operationally unprepared for large-scale crypto management before this alleged theft. This gap will likely accelerate regulatory pressure for mandatory cold-storage protocols, multi-signature requirements, and third-party audit frameworks for government-held digital assets—potentially establishing new compliance precedents that ripple into institutional custody standards.
ZachXBT's public blockchain analysis and threat actor identification method—tracing through braggadocio on recorded calls—demonstrates how on-chain forensics increasingly substitutes for traditional law enforcement detective work. However, it also signals that self-custody and privacy remain asymmetrically difficult for government actors managing large crypto portfolios, versus sophisticated individual threat actors moving and laundering funds with relative ease.