John Daghita, also known by the online alias "Lick," is a 25-year-old American national who was arrested by the Federal Bureau of Investigation (FBI) in March 2026 in connection with the alleged theft of cryptocurrency valued at around 46 million. ^[1] The funds were allegedly stolen from digital wallets containing assets previously seized by the United States government and held in the custody of the U.S. Marshals Service (USMS). ^[2] Daghita is the son of Dean Daghita, the President and CEO of Command Services & Support (CMDSS), a private government contractor hired to manage the seized assets, a connection authorities allege was central to the theft. ^[3]​

Alleged Cryptocurrency Theft

John Daghita is accused of orchestrating the theft of a large cache of cryptocurrency that was under the custody of the U.S. Marshals Service. The assets had been seized by the U.S. government in connection with the 2016 Bitfinex hack. ^{[3] [2]}​

Value of Stolen Assets

There are conflicting reports from media outlets and official announcements regarding the total value of the stolen cryptocurrency.

• Some sources, including The Block, Panews Lab, and Crypto.news, report the figure as over $40 million. ^{[2] [3] [1]}
• Other sources, including Forbes, CBS News, and initial FBI announcements, cite a higher figure of approximately $46 million. ^{[1] [3]}

Method of Theft

The theft was allegedly accomplished by exploiting his father's role as the President and CEO of Command Services & Support (CMDSS), a firm contracted by the U.S. Marshals Service. ^[2] CMDSS was hired to provide custody and management solutions for seized digital assets, particularly for more obscure "Class 2–4" tokens that required specialized handling. ^[3] Daghita is accused of leveraging this privileged access or information to gain control of the secure wallets and transfer funds to wallets under his personal control. ^[1]​

On-chain data indicates that multiple illicit transactions occurred. In March 2024, a wallet linked to Daghita reportedly received 20 million was drained from government-controlled wallets. While the majority of these funds were returned within 24 hours, about $700,000, which had been sent through instant exchanges, was not recovered. ^[2]​

Investigation and Public Exposure

The case was brought to public and law enforcement attention primarily through the work of independent on-chain investigator ZachXBT. ^[2]

ZachXBT's Investigation

On January 23, 2026, ZachXBT published a detailed report claiming to have identified John Daghita as the individual behind the theft. ^[2] The investigation connected Daghita to over $90 million in suspected illicit crypto activities. ^[3] The key breakthrough came from analyzing Daghita's online behavior in a Telegram group chat. ^[2]

The "Band-for-Band" Dispute

The critical evidence emerged during a public argument in a Telegram group, often referred to as a "band-for-band" dispute, where participants boast about their wealth. To prove he controlled more funds than another user, the user "Lick," alleged to be Daghita, took several actions that were recorded and later analyzed by ZachXBT. ^[3]

During the dispute, "Lick" allegedly:

1. Screen-shared his Exodus crypto wallet, which revealed a Tron (TRX) address holding approximately $2.3 million. ^[3]
2. Executed a live transaction, showing a public transfer of approximately $6.7 million in Ether (ETH) to one of his addresses. ^[2]
3. Consolidated funds, gathering approximately $23 million into a single wallet during the course of the argument. [[crypto.news/who-is-john-daghita-inside-the-us-governments-40m-crypto-theft-case/]]

ZachXBT then traced the transaction history of the wallet addresses revealed in the screen share. The on-chain analysis directly connected the consolidated funds back to a known U.S. government wallet holding assets seized from the Bitfinex case, thereby linking the "Lick" persona, and by extension Daghita, to the missing government funds. ^{[2] [3]}

Daghita's Reaction

Following the public exposure by ZachXBT in January 2026, Daghita allegedly reacted defiantly. He reportedly mocked the investigator on his personal Telegram channel and is accused of sending a "dust attack"—a transaction with a minuscule amount of cryptocurrency—to ZachXBT's publicly known wallet address using a portion of the stolen funds as a taunt. ^[1]

Arrest

John Daghita was arrested on or around March 4, 2026. The FBI Washington Field Office (FBIWFO) announced the arrest on March 5, 2026, stating it was conducted "along with our international partners." ^{[3] [1]}​

A post on X (formerly Twitter) from the FBI Washington Field Office stated: "Yesterday, #FBIWFO, along with our international partners, arrested a man for allegedly stealing millions of dollars in virtual currency from a government wallet." ^[3] FBI Director Kash Patel's account also stated: "Yesterday, the FBI, alongside our international partners, arrested John Daghita for his alleged theft of over $40 million in cryptocurrency from the U.S. Government." ^[3]​

As of March 6, 2026, Daghita is in federal custody, and formal charges are expected. The case has not yet been adjudicated in court. ^[2]​