- Trending
- Comments
- Latest
A blockchain investigator has accused the son of a U.S. Marshals Service crypto custody contractor of stealing more than $40 million in seized digital assets, including funds linked to the 2016 Bitfinex hack.
ZachXBT published the allegations on January 25, naming John Daghita—whose father Dean Daghita leads Command Services & Support, a firm hired in October 2024 to manage complex cryptocurrencies for the Marshals Service—as the individual behind the suspected theft.
ZachXBT, a well-known independent blockchain investigator, alleges that an individual operating online under the alias “Lick,” identified as John Daghita, played a role in siphoning tens of millions of dollars in digital assets from U.S. government wallets.
According to the investigation, the suspected crypto theft involved wallets holding assets previously seized by U.S. authorities, including funds linked to the 2016 Bitfinex hack.
ZachXBT further claims that John Daghita is the son of Dean Daghita, the president of Command Services & Support (CMDSS), a Virginia-based company awarded a U.S. Marshals Service contract in October 2024.
The contract authorized CMDSS to assist in managing and disposing of “Class 2–4” seized cryptocurrencies assets typically unsupported by major centralized exchanges and therefore more complex to custody.
The allegations have not been tested in court, and no criminal charges have been announced. CMDSS did not respond to requests for comment at the time of publication. The U.S. Marshals Service has also not publicly addressed the specific crypto theft claims outlined in ZachXBT’s report.
The investigation builds on findings ZachXBT released on January 23, linking an individual known as “John” or “Lick” to more than $90 million in suspected illicit cryptocurrency flows.
The probe gained momentum after a recorded argument in a Telegram group chat between two individuals disputing control over digital assets—a confrontation described as “band for band” by ZachXBT, referencing a slang term used to compare wealth.
During the exchange, the alleged threat actor reportedly screen-shared an Exodus wallet containing a Tron address with approximately $2.3 million.
Additional transfers followed in real time, including about $6.7 million in ether sent to an Ethereum address. By the end of the exchange, roughly $23 million had been consolidated into a single wallet, according to transaction data reviewed by ZachXBT.
Tracing those funds backward, the investigator linked the wallet to another address that received $24.9 million from a U.S. government-controlled wallet in March 2024. That government address was associated with assets seized from the Bitfinex hack.
ZachXBT had previously flagged suspicious activity in October 2024, when around $20 million was briefly drained from government wallets. Most of those funds were returned within 24 hours, though approximately $700,000 routed through instant exchanges was not recovered an episode that continues to inform the current crypto theft narrative.
CMDSS’s role in handling seized digital assets has faced scrutiny before. The firm secured the Marshals Service contract over competitors such as Wave Digital Assets, which subsequently filed a protest with the U.S. Government Accountability Office (GAO).
Wave alleged that CMDSS lacked proper licensing with the Securities and Exchange Commission and the Financial Industry Regulatory Authority, and raised concerns about potential conflicts of interest tied to the hiring of a former Marshals Service official.
The GAO ultimately rejected the protest, concluding that the agency’s evaluation process was “reasonable” — Government Accountability Office, in its decision denying the challenge.
Despite that ruling, the latest crypto theft allegations have renewed attention on how seized digital assets are tracked and safeguarded.
A February 2025 CoinDesk report highlighted systemic challenges within the Marshals Service, noting that the agency could not provide even a rough estimate of its bitcoin holdings and had relied on spreadsheets lacking robust inventory controls.
While ZachXBT’s claims remain unproven, they underscore persistent vulnerabilities in public-sector crypto custody at a time when seized digital assets are growing in scale and complexity.
The alleged connection between a suspected actor and a contractor executive has amplified calls for clearer separation of duties, stronger audits, and improved transparency across agencies handling seized cryptocurrencies.
As governments increasingly rely on private firms to manage digital assets, the episode illustrates how a single crypto theft incident can raise broader questions about trust, accountability, and institutional readiness.
For now, the investigation remains in the public domain, with market participants, policymakers, and security experts watching closely to see whether further disclosures or official responses will follow.
