Allegations of Wallet Theft Involving Son of US Government Crypto Custodian CEO

Blockchain investigator ZachXBT has put forth allegations claiming that the son of a CEO from a firm tasked with safeguarding seized cryptocurrencies may be behind a substantial theft of digital assets from U.S. government-controlled wallets. These claims remain unverified in court.

Key Takeaways

ZachXBT suggests a multimillion-dollar cryptocurrency theft from U.S. government wallets is linked to the son of the CEO of a federal crypto custody contractor.
The stolen funds are associated with assets seized in the notorious 2016 Bitfinex hack.
These allegations have not been substantiated with legal charges as of the article's publication.

In a detailed series of posts, ZachXBT asserted that an individual known online as “Lick,” whose real identity he claims is John Daghita, took tens of millions of dollars in cryptocurrency from wallets affiliated with the U.S. government.

ZachXBT also alleged that Daghita is the son of Dean Daghita, the president and CEO of Command Services & Support (CMDSS), a firm that has a contract with the U.S. Marshals Service to manage specific seized digital assets.

ZachXBT Alleges Son of US Government Crypto Custodian CEO Behind Wallet Theft

CMDSS Awarded US Marshals Contract for Handling Seized Crypto

Public records indicate that CMDSS, which is based in Haymarket, Virginia, received a contract in October 2024 aimed at assisting the Marshals Service in managing and disposing of "Class 2–4" digital assets. This classification refers to tokens that may not be supported by major centralized exchanges and often need specialized handling.

As it stands, these allegations have not been tested in a court of law, and no criminal charges have been filed yet. CMDSS did not provide a comment by the time of this article's publication.

ZachXBT’s claims complement an earlier investigation he released on January 23, which associated the same online persona with over $90 million in suspected illegal cryptocurrency activities. This earlier probe traced funds back to a U.S. government wallet linked to assets seized in the 2016 Bitfinex hack.

The investigation gained attention following a recorded argument in a Telegram group chat involving “Lick” and another participant. They engaged in a “band-for-band” dispute to showcase ownership of significant crypto balances.

During this discussion, “Lick” screen-shared an Exodus wallet, which displayed a Tron address holding around $2.3 million, followed by a live transfer of roughly $6.7 million in ether. By the end of the chat, around $23 million had been aggregated into one wallet.

Through backward transaction tracing, ZachXBT linked this wallet to an address that received $24.9 million from a U.S. government-controlled wallet in March 2024, which was tied to funds seized in the Bitfinex case. Notably, in October 2024, ZachXBT had signaled unusual activity when approximately $20 million was drained from similar government wallets. Most of those funds were recovered within 24 hours, but about $700,000 that moved through instant exchanges remains unrecovered.

CMDSS Contract Faced Previous Scrutiny

The role of CMDSS as a government contractor has faced scrutiny in the past. After losing the Marshals Service contract, Wave Digital Assets lodged a protest with the Government Accountability Office (GAO), alleging that CMDSS did not have appropriate regulatory registrations and raising potential conflict of interest concerns involving a former Marshals Service official. Ultimately, the GAO denied the protest.

Questions regarding the oversight of crypto custody have been raised as well. A February 2025 CoinDesk report highlighted that the Marshals Service struggled with tracking its digital asset holdings, citing inadequate inventory controls and difficulties in estimating its bitcoin reserves. Recent reports also indicated that illicit cryptocurrency addresses received a record $154 billion in 2025, marking a significant increase from the previous year.