US Marshals Wallet Drained: Contractor’s Son Allegedly Exposed Keys in $40M Telegram ‘Flex’
A bragging contest on Telegram led investigators to a $40M theft from US government wallets, allegedly perpetrated by the son of the federal custody contractor.
The United States Marshals Service (USMS) is actively investigating a breach of government-controlled cryptocurrency wallets after blockchain investigator ZachXBT publicly identified the alleged perpetrator as John “Lick” Daghita. The suspect, son of Command Services & Support (CMDSS) CEO Dean Daghita, reportedly siphoned over $40 million in seized assets, including funds from the 2016 Bitfinex hack, while his father’s firm held the federal custody contract.
The Receipt: A $40 Million ‘Self-Snitch’
The breach was not discovered through a federal audit, but via a “band for band” wealth-bragging contest on Telegram. During a dispute, the suspect screen-shared an Exodus wallet to prove his liquidity. ZachXBT traced the visible assets directly back to USMS seizure addresses.
The on-chain trail is damning:
- The Source: Address
0xc7a2, a known US government wallet holding confiscated Bitfinex assets. - The Flow: A $24.9 million transfer executed in March 2024, followed by a separate $20 million drain in October (partially returned, with ~$700k still missing).
- The Link: The destination wallets matched the addresses Daghita flaunted on video.
The Custody Failure
The systemic failure here is vertical. CMDSS was awarded the USMS contract in October 2024 to manage “Class 2-4” digital assets. Tokens too complex for standard liquidation. This gave the firm, and allegedly the CEO’s son, operational proximity to keys securing hundreds of millions in federal property.
The suspect inadvertently exposed their controlled wallet address in a Telegram group chat video bragging about their wealth… confirming fund linkage through on-chain analysis.
While Bitcoin ($87,719) and Ethereum ($2,943) shrugged off the news with minor intraday losses (-1.8%), the breach exposes a critical vulnerability in the government’s custody framework just as Washington discusses a strategic Bitcoin reserve.
What’s Next
The USMS has confirmed the active investigation. CMDSS has gone dark, scrubbing its website and social media presence. No arrests have been formally announced as of Tuesday evening, but the swift attribution suggests federal law enforcement is closing the net.
