Skip to main content

$40 Million+ US Govt Crypto Heist Leads To Contractor Exec’s Son: ZachXBT

On-chain investigator ZachXBT says a $40 million-plus theft from US government crypto seizure wallets may trace back to John Daghita, an alleged threat actor who goes by “Lick,” and a contractor relationship tied to Daghita’s family.

The $40 Million+ Govt Crypto Wallet Robbery

In a Jan. 25 post, ZachXBT pointed to Command Services & Support (CMDSS), describing it as a firm with “an active IT government contract in Virginia,” and alleging it was “awarded a contract to assist the USMS in managing/disposing of seized/forfeited crypto assets.” ZachXBT added: “It still remains unclear at this point how John obtained access from his dad.”

The allegation lands against a backdrop of earlier tracing work published Jan. 23, where ZachXBT linked wallet activity and recorded chats to the same persona. “Meet the threat actor John (Lick), who was caught flexing $23M in a wallet address directly tied to $90M+ in suspected thefts from the US Government in 2024 and multiple other unidentified victims from Nov 2025 to Dec 2025,” ZachXBT wrote.

ZachXBT’s thread centers on a dispute in a Telegram group chat between “John” and another threat actor, Dritan Kapplani Jr., in what the community calls “band for band (b4b)”, an on-the-spot contest to prove who controls more funds. ZachXBT said the interaction was “fully recorded,” and claims the footage includes screen-shared wallet balances and contemporaneous transfers that help establish control.

According to the thread, the recording shows John screen-sharing an Exodus wallet displaying a Tron address holding $2.3 million. In a second segment, ZachXBT said “another $6.7M worth of ETH” moved into an Ethereum address while the argument continued.

ZachXBT framed the key evidentiary point as ownership continuity across addresses: “The recording captures that John clearly controls both addresses. Additional addresses can likely be found in the recordings. I then began tracing backwards to verify the source of funds.”

That tracing, ZachXBT said, connects the cluster to a March 2024 transfer of $24.9 million from a US government address tied to the Bitfinex crypto hack seizure. He also claimed $18.5 million “currently sits” at a cited address.

Beyond that 2024 linkage, ZachXBT asserted the primary address he tracked was tied to “$63M+ inflows from suspected victims and government seizure addresses in Q4 2025,” listing multiple transactions and chains, and separately flagged an additional 4.17K ETH ($12.4 million) flow from MEXC into the same cluster.

The Jan. 25 post attempts to explain a potential access path: if CMDSS was involved in US Marshals Service crypto asset management, the question becomes whether contractor-side systems, credentials, or processes provided an opening, intentionally or otherwise. ZachXBT stressed that the exact mechanism remains unknown.

Shortly after the post, ZachXBT said CMDSS’s X account, website, and LinkedIn “were all just deactivated,” and claimed Daghita “began trolling again on Telegram.”

On X, the claims drew sharp reactions from prominent Bitcoin commentators. Nakamoto Inc. CEO David Bailey wrote: “The son of the CEO of the company hired by the US Marshalls to safeguard the nation’s Bitcoin, stole $40m from it and now appears to be running. Treasury must secure the private keys from the Justice Department ASAP before more is stolen.”

Prominent Bitcoin advocate and co-founder of the Satoshi Nakamoto Institute Pierre Rochard framed the situation in national-security terms, posting, “This is a national security crisis,” and urging Congress to pass the BITCOIN Act.

At press time, Bitcoin traded at $87,847.

Bitcoin price chart

from Bitcoinist.com https://ift.tt/WXGU4vN
Labels:

Comments

Post a Comment

Popular posts from this blog

Coinbase Adds Wormhole To Spot Trading As Solana Infrastructure Tokens Gain Visibility

Coinbase listings still matter, even in a market that likes to pretend every token is already globally accessible. The exchange ’s decision to add Wormhole puts another major infrastructure name in front of a much broader pool of traders. That matters because Wormhole is not just another speculative ticker. It sits inside one of crypto’s most important, and most debated, categories: cross-chain connectivity. For more details, visit the official Coinbase platform. TL;DR Coinbase is adding support for Wormhole’s W token on spot markets. The listing gives a higher-profile venue to a token tied to cross-chain infrastructure. It also keeps Solana ecosystem names in front of mainstream exchange users. Why A Wormhole Listing Is Interesting Bridge and messaging infrastructure often do not get the same retail attention as consumer-facing protocols, but they matter enormously to how liquidity and applications move between ecosystems. Coinbase’s listing helps push t...
Post a Comment
Read more

Ethereum On Exchanges Crashes To Historic Low Amid Market Volatility, A Bullish Signal For Price?

Ethereum saw a bounce back above the $3,000 price market , with bullish sentiment gaining momentum among investors, especially those on centralized exchanges. Even with the market experiencing sideways movements, the overall supply of ETH on crypto exchanges has fallen sharply, hitting unprecedented levels. Lowest Supply Of Ethereum On Exchanges Recent signals from on-chain metrics indicate that the Ethereum market environment is undergoing a quiet yet significant transformation. This unfolding trend is due to the sharp drop in the supply of ETH available on cryptocurrency exchanges. Related Reading: Ethereum Network Fatigue? Monthly On-Chain Transactions Drops As Activity Slows Down As reported by Coin Bureau on the social media platform X, ETH supply on centralized exchanges has hit levels not seen in years. With more holders choosing long-term storage, staking, and self-custody over keeping their assets available for trade, this significant supply drain indicates a change in i...
Post a Comment
Read more

Bitcoin Remains Range-Bound As Volatility Declines – Analyst Explains Price Action

Bitcoin has experienced frustrating price action in recent weeks, leaving investors impatient about its short-term direction. The price has been testing crucial supply levels between $98K and $100K, struggling to break out as uncertainty dominates the market. The lack of a clear move has led to speculation about whether BTC is preparing for a breakout or another correction. Adding to the uncertainty, the market was hit by negative news on Friday when crypto exchange Bybit was hacked, resulting in the theft of $1.4 billion in ETH. The incident caused fear and volatility, briefly dragging prices lower. However, Bybit responded quickly to reassure investors, easing some of the initial panic and stabilizing the market. Despite this, Bitcoin continues to consolidate in a tight range. Crypto expert Daan shared an analysis on X, noting that BTC is still ranging while volatility is steadily decreasing. As price compression increases, traders are on high alert for a potential explosive move....
Post a Comment
Read more