Understanding the $40 Million Crypto Theft Case Involving John Daghita

In a shocking revelation in the cryptocurrency space, blockchain investigator ZachXBT claims that the son of a federal crypto custody contractor's CEO played a role in a multimillion-dollar crypto theft from U.S. government-linked wallets. This incident highlights significant custody risks within the digital asset landscape.

Key Takeaways

ZachXBT alleges that John Daghita, the son of a CEO from a custody firm, stole tens of millions in crypto linked to U.S. government wallets.
The stolen funds are reportedly associated with assets seized during the 2016 Bitfinex hack.
The investigation intensified following a revealing argument on Telegram regarding control over large crypto balances.
There are ongoing concerns regarding the integrity of digital asset custody practices within government agencies.

ZachXBT links $40M crypto theft to US custody contractor’s son.

Allegations Unfurled

ZachXBT has brought forward allegations during his in-depth investigation that an individual known online as "Lick," identified as John Daghita, allegedly siphoned off tens of millions in cryptocurrency from wallets connected to the U.S. government. This claim has not yet been verified in court and has evoked significant attention within the cryptocurrency community.

Daghita is said to be the son of Dean Daghita, who serves as president and CEO of Command Services & Support (CMDSS). This Virginia-based company is contracted by the U.S. Marshals Service to securely manage seized digital assets categorized as “Class 2–4” tokens, which require specialized custody solutions.

Links to the Bitfinex Hack

On-chain investigations highlighted by ZachXBT suggest the misappropriated funds are tied to assets obtained in the infamous 2016 Bitfinex hack. Notably, one wallet received a deposit of $24.9 million from a U.S. government-controlled wallet in March 2024.

This inquiry builds on prior findings released on January 23, which indicated that the "Lick" persona was linked to over $90 million in suspected illicit cryptocurrency activities funneled through various addresses affiliated with government-controlled wallets.

Telegram Dispute Investigation

According to reports, the investigation gained momentum after a heated exchange on Telegram, where two individuals engaged in a “band-for-band” argument showcasing their control over large crypto balances. During this conversation, ZachXBT mentions that “Lick” shared his screen to reveal an Exodus wallet containing about “$2.3 million” in Tron. He proceeded to conduct a live transfer of approximately “$6.7 million in ether,” ultimately consolidating an estimated “$23 million” into a single wallet traceable back to a U.S. government address.

CMDSS and Systemic Concerns

The controversy surrounding CMDSS is not new. The firm's selection faced challenges when Wave Digital Assets submitted a protest to the Government Accountability Office (GAO), asserting that CMDSS lacked critical registrations and posed potential conflicts involving a former Marshals Service official. However, the GAO subsequently denied the protest.

A separate report published by CoinDesk in 2025 emphasized the difficulties the Marshals Service encountered in reconciling their digital asset holdings, further stressing broader concerns related to federal crypto custody. Notably, illicit addresses absorbed a record $154 billion in 2025, an alarming increase from previous years.

Current Market Landscape

This alleged breach occurs amid a cryptocurrency market largely dominated by Bitcoin, which is trading at approximately $87,700–$87,900, having declined nearly 1% over the past 24 hours, with daily trading volumes around $40 billion. Ethereum is currently priced between €3,150 and €3,200, reflecting a gain of about 3% in the last day. Meanwhile, Solana is trading around €151 after experiencing a slip of roughly 2% during the same timeframe. This indicates that the market's focus remains on macroeconomic trends rather than isolated custodial failures—at least for the moment.

This incident raises vital questions about the reliability of custody solutions in the cryptocurrency sector and their impact on regulatory practices moving forward.