US Gov Contractor’s Son Identified as $40M Crypto Thief

The pseudonym responsible for draining over $40 million from U.S. government forfeiture wallets has been unmasked. In a report released Sunday, on-chain investigator ZachXBT identified the thief as John Daghita, operating under the alias “Lick.”

Daghita is the son of Dean Daghita, CEO of Command Services & Support (CMDSS), the very contractor hired by the U.S. Marshals Service (USMS) to secure seized digital assets.

The Receipt: A $23M Flex

The exposure did not come from advanced forensics, but from a Telegram dispute. During a “band for band” argument (a verifiable wealth comparison), Daghita screen-shared a Ledger Live interface containing $23 million in crypto to prove his net worth. ZachXBT matched the specific UTXOs and transaction timestamps from the screen share to a wallet that received $24.9 million directly from U.S. government seizure addresses in March 2024.

These funds included assets originally confiscated during the 2016 Bitfinex hack recovery.

“The claim builds on ZachXBT’s earlier investigation linking an individual known as ‘John’ or ‘Lick’ to over $90 million in suspected stolen crypto.” . The Block

Institutional Context: The “Class 2-4” Loophole

This incident exposes a catastrophic failure in federal vendor vetting. While Coinbase holds the primary contract for “Class 1” assets (major liquid tokens like BTC and ETH), CMDSS was awarded the contract for “Class 2-4” assets, illiquid or complex tokens requiring specialized handling, in October 2024.

Competitor Wave Digital Assets had formally protested the CMDSS award, citing potential conflicts of interest and lack of licensure. The Government Accountability Office (GAO) denied that protest in March 2025. Following ZachXBT’s report, CMDSS has deactivated its website and deleted its LinkedIn and X accounts.

The USMS has not yet issued a statement regarding the breach of its custody chain.