The State's Own Thief: How a US Marshals Contractor's Son Stole $46 Million in Seized Bitcoin

An Inside Job

This isn't an outside hacker, an exploit against a smart contract, or an attack on an exchange. It's embezzlement in its simplest form: someone with privileged access to funds simply started withdrawing them. The difference is that these funds belonged to the United States government — cryptocurrency seized in criminal investigations, including a portion of the loot recovered from the 2016 Bitfinex hack, one of the largest bitcoin thefts in history.

At the center of the case: John "Lick" Daghita, 21, son of Dean Daghita, president of Command Services & Support (CMDSS), a Virginia-based company holding an active contract with the U.S. Marshals Service for the "custody and disposal" of confiscated digital assets. In practice, the family business had exclusive access to wallets holding billions of dollars in government cryptocurrency.

How It Started: A Brag on Telegram

The investigation didn't start with a government audit — it started with independent work by blockchain detective ZachXBT. In late January 2026, during what's known in crypto culture as a "band for band" — an informal contest where anonymous users show off control of large digital holdings in real time to prove financial dominance — a user going by "Lick" screen-shared a wallet holding roughly $23 million.

During the session, in real time, another $6.7 million in Ethereum flowed into the same address, bringing the consolidated total to roughly $23 million. That screen share turned out to be a fatal mistake: it let ZachXBT directly observe transaction IDs and fund movements, tracing them back to a US government-controlled wallet tied to assets seized in the Bitfinex case.

One transaction in particular showed a transfer of roughly $24.9 million from that government wallet back in March 2024 — not an isolated incident, but a withdrawal that had gone unnoticed for months. ZachXBT had already flagged suspicious activity on the same wallet in October 2024 (about $20 million withdrawn, mostly returned within 24 hours, except roughly $700,000 routed through instant-swap services and never recovered).

Case Timeline

The Identification

Tracing the addresses involved, ZachXBT linked "Lick" to John Daghita, suggesting a connection to Dean Daghita and CMDSS. On January 26, 2026, the U.S. Marshals Service confirmed a formal investigation had opened. By then, the estimated shortfall had already climbed past $25 million — and would keep rising in the following weeks, eventually surpassing $46 million (with some estimates, per Bitcoin Magazine, pushing the total as high as $90 million once suspicious activity observed as early as late 2025 is factored in).

One question remains unresolved, as ZachXBT himself noted: it has never been publicly clarified how John obtained access to wallets managed by his father's company.

The Arrest: An International Raid in the Caribbean

On the night of March 4-5, 2026, Daghita was arrested on the Caribbean island of Saint Martin in a joint FBI-French Gendarmerie operation, including the elite tactical unit GIGN, with support from the Gendarmerie's international team based in Guadeloupe.

FBI Director Kash Patel announced the arrest directly on X, posting photos: Daghita in handcuffs, and a metal briefcase containing stacks of $100 bills alongside Trezor hardware wallets — devices used to store cryptocurrency private keys offline.

According to US media reports, American authorities are now expected to pursue extradition. As of this writing, there are no further public updates on a formal indictment, fund recovery, or additional arrests connected to the case.

Why It Matters

If a 21-year-old with no official role in the federal contract could tap into those wallets for months without any internal control noticing, the open question concerns every other private contractor Washington entrusts with managing seized digital assets — and how solid that oversight system really is.