{"investigation":{"slug":"john-daghita-aka-lick-us-marshals-crypto-theft","entity_name":"John Daghita (aka Lick) — US Marshals Crypto Theft","trust_score":26,"severity_base":26,"score_modifier":0,"confidence":0.95,"status":"published","content_type":"investigation","summary":"John Daghita, who used the online alias \"Lick,\" was arrested by French gendarmerie and the FBI on Saint Martin in March 2026 over allegations he stole tens of millions of dollars in cryptocurrency from U.S. government wallets tied to a U.S. Marshals Service (USMS) contract held by his father's firm, Command Services & Support (CMDSS). The allegations, first raised by blockchain investigator ZachXBT, are well corroborated by multiple news outlets and the FBI's own public statements, and a French appeals court authorized his extradition to the United States in May 2026; however, no DOJ press release, indictment filing, or court docket confirming specific federal charges or a count total could be located, and several granular details reported elsewhere (exact seized-cash figures, named luxury items, specific field-office attributions beyond one source) remain unverified.","sections":[{"content":"Command Services & Support (CMDSS), a Virginia-based firm led by president and CEO Dean Daghita, held a U.S. Marshals Service contract — reported by Fortune as worth approximately $4 million, awarded around October 2024 — to assist with the custody and disposition of certain cryptocurrency the government had seized, including assets connected to the 2016 Bitfinex hack. Blockchain investigator ZachXBT alleged that John Daghita, who used the alias \"Lick,\" is Dean Daghita's son and may have obtained unauthorized access to USMS-linked wallets through that contract. TRM Labs and other outlets noted this family relationship was based on ZachXBT's reporting and had not, at the time, been confirmed by authorities. Fortune additionally reported that competitors had unsuccessfully challenged the CMDSS contract award before the Government Accountability Office, which found the award was not improper, and that CMDSS removed contact information from its website after the allegations surfaced.","heading":"Background: CMDSS Government Contract and the Alleged Family Link","sources":[{"url":"https://fortune.com/2026/02/06/us-marshals-service-scrutiny-insider-allegedly-stole-25-million-federal-crypto-wallets/","name":"Fortune: US Marshals Service scrutiny over insider theft from federal crypto wallets","type":"news_article","credibility":1},{"url":"https://trmlabs.com/resources/blog/john-daghita-aka-john-lick-arrested-in-alleged-cryptocurrency-theft-tied-to-us-marshals-service","name":"TRM Labs: John Daghita aka \"John/Lick\" arrested in alleged cryptocurrency theft tied to US Marshals Service","type":"research","credibility":2}],"severity":"high"},{"content":"Reporting describes at least two phases of alleged theft. An initial incident, reported by Merkle Science and others, involved roughly $20–25 million in cryptocurrency taken from a U.S. government-controlled wallet in October 2024; most of the funds were reportedly returned to the government address shortly afterward, though a portion was not recovered. A second, much larger set of transfers was identified by ZachXBT in January 2026, who said wallets linked to \"Lick\" held in excess of $90 million in suspected stolen or victim funds, including amounts traced to the earlier government seizure wallet. FBI Director Kash Patel's public statement at the time of the arrest put the total theft from U.S. Marshals Service holdings at more than $46 million, the figure most consistently cited by mainstream outlets. More granular figures circulating in crypto-media aggregation (e.g., specific multi-million-dollar transfers on particular dates in December 2025 and January 2026, and a described 20-minute diversion of a $2 million USMS-directed transfer) trace back to a single journalist's social-media posts that could not be independently located or verified in this review; they should be treated as unconfirmed.","heading":"The Alleged Theft: Amounts and Timeline","sources":[{"url":"https://www.merklescience.com/blog/hack-track-us-government-hack-of-recovered-bitfinex-hack-funds","name":"Merkle Science: Hack Track — US government hack of recovered Bitfinex hack funds","type":"research","credibility":2},{"url":"https://www.theblock.co/amp/post/392431/suspect-alleged-46-million-us-marshals-crypto-theft-arrested-saint-martin-fbi","name":"The Block: Suspect in alleged $46 million US Marshals crypto theft arrested in Saint Martin, FBI says","type":"news_article","credibility":2},{"url":"https://trmlabs.com/resources/blog/john-daghita-aka-john-lick-arrested-in-alleged-cryptocurrency-theft-tied-to-us-marshals-service","name":"TRM Labs: John Daghita aka \"John/Lick\" arrested in alleged cryptocurrency theft tied to US Marshals Service","type":"research","credibility":2}],"severity":"critical"},{"content":"According to web3isgoinggreat.com, a site that tracks crypto scams and incidents, blockchain investigator ZachXBT's investigation began after \"Lick\" and another individual screenshared wallet balances during a private Telegram dispute in which participants display and transfer funds to prove relative wealth (sometimes called \"band for band\"). ZachXBT traced the disclosed wallet to tens of millions of dollars he alleged were taken from U.S. government-seizure wallets. After ZachXBT's reporting named Daghita, the \"Lick\" account reportedly deleted content, and Daghita allegedly sent ZachXBT a small amount of the disputed funds (about 0.68 ETH) while continuing to taunt him online; CMDSS also reduced its public online footprint around the same period. These events are documented contemporaneously across crypto-focused outlets but rest substantially on ZachXBT's own published analysis rather than confirmed law-enforcement findings.","heading":"Discovery: ZachXBT's Investigation and the Telegram Incident","sources":[{"url":"https://www.web3isgoinggreat.com/single/lick-theft","name":"Web3 Is Going Great: Thief of millions in seized U.S.-controlled crypto alleged to be government crypto contractor's son","type":"research","credibility":2},{"url":"https://fortune.com/2026/02/06/us-marshals-service-scrutiny-insider-allegedly-stole-25-million-federal-crypto-wallets/","name":"Fortune: US Marshals Service scrutiny over insider theft from federal crypto wallets","type":"news_article","credibility":1}],"severity":"high"},{"content":"In late January 2026, a token called \"John Daghita (LICK)\" was launched on the Pump.fun platform, according to Cointelegraph. On-chain analytics firm Bubblemaps said the token's deployer wallet held roughly 40% of total supply at launch — a concentration commonly flagged as a risk indicator — and the token lost about 97% of its value within its first day of trading after briefly reaching a market capitalization reported as between roughly $915,000 and $2.3 million (sources differ). Bubblemaps linked the token's launch to the broader theft allegations against Daghita. A U.S. Marshals Service spokesperson confirmed to Cointelegraph that the underlying theft matter was under investigation but declined further comment. The exact calendar day of the token's launch could not be independently confirmed; available reporting places it in late January 2026, days before Cointelegraph's January 28, 2026 article and around the time of ZachXBT's January 23, 2026 disclosure.","heading":"The $LICK Memecoin","sources":[{"url":"https://cointelegraph.com/news/us-treasury-theft-wallet-bundled-memecoin-crashes-97","name":"Cointelegraph: US Treasury theft wallet-bundled memecoin crashes 97%","type":"news_article","credibility":2},{"url":"https://cryptopotato.com/bubblemaps-flags-lick-token-as-on-chain-data-ties-launch-to-alleged-40m-us-government-theft/","name":"CryptoPotato: Bubblemaps flags LICK token as on-chain data ties launch to alleged $40M US government theft","type":"news_article","credibility":2}],"severity":"medium"},{"content":"FBI Director Kash Patel announced in a post on X on the morning of Thursday, March 5, 2026, that John Daghita had been taken into custody on the Caribbean island of Saint Martin in a joint operation involving the FBI and French gendarmerie tactical units (reported variously as the Gendarmerie's International Cooperation Team Serious Crime Unit and the Groupe d'Intervention de la Gendarmerie Nationale of Guadeloupe). Multiple outlets, including Decrypt and the Los Angeles Magazine crime desk, reported the arrest itself occurred the night before the announcement. Reporting consistently describes Daghita as found with a metal briefcase containing U.S. currency, multiple hard drives, and security keys/hardware wallets; some accounts, sourced to ZachXBT, also mention expensive watches, though no outlet independently verified a specific brand, model, or exact cash total. Claims circulating elsewhere of a precise cash figure (e.g., $239,348), a named watch model (e.g., a Rolex GMT-Master), or a specific property name (\"Villa Sun Reset\") could not be corroborated in any independently reviewed source and are not included here as verified facts. TRM Labs reported that the FBI's Washington Field Office led the investigation with support from the Cleveland Field Office; this detail was not corroborated elsewhere but TRM Labs is treated as a credible research source.","heading":"Arrest in Saint Martin","sources":[{"url":"https://www.theblock.co/amp/post/392431/suspect-alleged-46-million-us-marshals-crypto-theft-arrested-saint-martin-fbi","name":"The Block: Suspect in alleged $46 million US Marshals crypto theft arrested in Saint Martin, FBI says","type":"news_article","credibility":2},{"url":"https://decrypt.co/360120/federal-contractors-son-arrested-charged-with-stealing-46-million-from-us-crypto-stockpile","name":"Decrypt: Federal Contractor's Son Arrested, Charged With Stealing $46 Million From US Crypto Stockpile","type":"news_article","credibility":2},{"url":"https://lamag.com/crimeinla/nepo-baby-whose-dad-manages-seized-assets-for-us-marshals-busted-on-ritzy-island/","name":"LA Magazine: Nepo baby whose dad manages seized assets for US Marshals busted on ritzy island","type":"news_article","credibility":2},{"url":"https://trmlabs.com/resources/blog/john-daghita-aka-john-lick-arrested-in-alleged-cryptocurrency-theft-tied-to-us-marshals-service","name":"TRM Labs: John Daghita aka \"John/Lick\" arrested in alleged cryptocurrency theft tied to US Marshals Service","type":"research","credibility":2}],"severity":"high"},{"content":"Multiple crypto-news outlets reported, following the March 2026 arrest, that Daghita was expected to face federal charges including wire fraud, theft of government property, and money laundering. However, extensive searching for this review found no DOJ or U.S. Attorney's Office press release, no PACER or court docket entry, and no primary charging document confirming an actual indictment, its date, or a specific count total. A figure of \"15 federal counts\" and an associated charge list, along with a claimed job title (\"Cryptocurrency Subject Matter Expert\") and a cited indictment date, that have circulated in secondary reporting trace back to a single journalist's social-media posts and could not be independently verified from any locatable primary source; they are not repeated here as confirmed facts. As of this review, the only consistently confirmed legal fact is that Daghita was arrested, held, and has been the subject of a French extradition proceeding brought at the request of U.S. authorities — which itself implies charges exist, but their formal content remains unconfirmed in public records located during this research.","heading":"Criminal Charges: Unverified Indictment Specifics","sources":[{"url":"https://phemex.com/news/article/french-court-reviews-extradition-of-american-accused-of-46m-crypto-theft-84748","name":"Phemex: French court reviews extradition of American accused of $46M crypto theft","type":"news_article","credibility":2}],"severity":"medium"},{"content":"An Agence France-Presse report datelined Basse-Terre, May 28, 2026, and carried by Ground News, said the investigation chamber (chambre de l'instruction) of the Cour d'Appel de Basse-Terre in Guadeloupe authorized Daghita's extradition to the United States. A French crypto-news outlet, cryptoactu, separately reported the same court and date, adding that Daghita's attorney said he had himself requested extradition, which simplified the proceeding, and that there is no fixed legal deadline for the subsequent transfer. A different outlet, Phemex, instead described a Bastia Court of Appeal and a Bastia detention center handling the matter; this detail conflicts with the Basse-Terre reporting corroborated by AFP and a French regional-facing outlet, and is treated as the less reliable account. No source located in this review confirms that Daghita has actually been physically transferred to U.S. custody or that an initial U.S. court appearance has occurred as of this writing.","heading":"Extradition Proceedings","sources":[{"url":"https://ground.news/article/guadeloupe-an-american-suspected-of-stealing-46-million-in-cryptocurrency-will-be-extradited","name":"Ground News (AFP): Guadeloupe — an American suspected of stealing $46 million in cryptocurrency will be extradited","type":"news_article","credibility":1},{"url":"https://cryptoactu.com/france-extradition-autorisee-vers-etats-unis/","name":"Cryptoactu: France — extradition autorisée vers les États-Unis","type":"news_article","credibility":2},{"url":"https://phemex.com/news/article/french-court-reviews-extradition-of-american-accused-of-46m-crypto-theft-84748","name":"Phemex: French court reviews extradition of American accused of $46M crypto theft","type":"news_article","credibility":2}],"severity":"medium"},{"content":"Fortune reported that USMS public affairs chief Brady McCarron confirmed to CoinDesk in late January 2026 that an investigation into the alleged theft was underway, but that USMS did not respond to subsequent questions about whether it continued to use CMDSS. Fortune also reported that competing bidders had previously challenged the USMS award to CMDSS before the Government Accountability Office, alleging the firm lacked proper credentials and had hired a former agency staffer in a way that created a conflict of interest; the GAO reportedly concluded the award was not improper. The episode has been cited by commentators as raising questions about oversight of private contractors with access to government-controlled cryptocurrency wallets, though no further regulatory or congressional action specific to this case was identified in this review.","heading":"Government Oversight and Systemic Failures","sources":[{"url":"https://fortune.com/2026/02/06/us-marshals-service-scrutiny-insider-allegedly-stole-25-million-federal-crypto-wallets/","name":"Fortune: US Marshals Service scrutiny over insider theft from federal crypto wallets","type":"news_article","credibility":1}],"severity":"medium"}],"timeline":[{"date":"2024-10","event":"CMDSS, led by Dean Daghita, reported to have been awarded a U.S. Marshals Service contract (reported at roughly $4 million) to assist with custody/disposition of seized cryptocurrency; around the same month, roughly $20–25 million was allegedly taken from a US government-controlled wallet tied to Bitfinex-hack seizure funds, with most later returned.","source":"TRM Labs / Merkle Science","source_url":"https://trmlabs.com/resources/blog/john-daghita-aka-john-lick-arrested-in-alleged-cryptocurrency-theft-tied-to-us-marshals-service"},{"date":"2026-01","event":"Blockchain investigator ZachXBT published findings tracing a Telegram \"band-for-band\" wealth-flexing dispute to wallets allegedly linked to tens of millions of dollars in stolen funds, and separately identified the suspect as \"Lick,\" alleged to be John Daghita.","source":"Web3 Is Going Great","source_url":"https://www.web3isgoinggreat.com/single/lick-theft"},{"date":"2026-01","event":"A memecoin named \"John Daghita (LICK)\" launched on Pump.fun and crashed roughly 97% within a day; Bubblemaps flagged the deployer's concentrated token holdings and tied the launch to the theft allegations.","source":"Cointelegraph","source_url":"https://cointelegraph.com/news/us-treasury-theft-wallet-bundled-memecoin-crashes-97"},{"date":"2026-02","event":"Fortune reported that the US Marshals Service confirmed an active investigation into the alleged theft and detailed prior GAO scrutiny of the CMDSS contract award.","source":"Fortune","source_url":"https://fortune.com/2026/02/06/us-marshals-service-scrutiny-insider-allegedly-stole-25-million-federal-crypto-wallets/"},{"date":"2026-03-05","event":"FBI Director Kash Patel announced that John Daghita had been arrested on Saint Martin in a joint FBI/French gendarmerie operation, accused of stealing more than $46 million in cryptocurrency from the US Marshals Service.","source":"The Block","source_url":"https://www.theblock.co/amp/post/392431/suspect-alleged-46-million-us-marshals-crypto-theft-arrested-saint-martin-fbi","date_evidence":"In a Thursday morning post on X, Patel said John Daghita was taken into custody; article byline dated March 5, 2026, 11:02AM EST."},{"date":"2026-05-28","event":"The investigation chamber of the Cour d'Appel de Basse-Terre in Guadeloupe authorized Daghita's extradition to the United States.","source":"Agence France-Presse via Ground News","source_url":"https://ground.news/article/guadeloupe-an-american-suspected-of-stealing-46-million-in-cryptocurrency-will-be-extradited","date_evidence":"Dateline: \"Basse-Terre, May 28, 2026 (AFP)\""}],"sources_used":[{"url":"https://fortune.com/2026/02/06/us-marshals-service-scrutiny-insider-allegedly-stole-25-million-federal-crypto-wallets/","name":"Fortune: US Marshals Service scrutiny over insider theft from federal crypto wallets","type":"news_article","credibility":1},{"url":"https://www.theblock.co/amp/post/392431/suspect-alleged-46-million-us-marshals-crypto-theft-arrested-saint-martin-fbi","name":"The Block: Suspect in alleged $46 million US Marshals crypto theft arrested in Saint Martin, FBI says","type":"news_article","credibility":2},{"url":"https://decrypt.co/360120/federal-contractors-son-arrested-charged-with-stealing-46-million-from-us-crypto-stockpile","name":"Decrypt: Federal Contractor's Son Arrested, Charged With Stealing $46 Million From US Crypto Stockpile","type":"news_article","credibility":2},{"url":"https://trmlabs.com/resources/blog/john-daghita-aka-john-lick-arrested-in-alleged-cryptocurrency-theft-tied-to-us-marshals-service","name":"TRM Labs: John Daghita aka \"John/Lick\" arrested in alleged cryptocurrency theft tied to US Marshals Service","type":"research","credibility":2},{"url":"https://www.merklescience.com/blog/hack-track-us-government-hack-of-recovered-bitfinex-hack-funds","name":"Merkle Science: Hack Track — US government hack of recovered Bitfinex hack funds","type":"research","credibility":2},{"url":"https://www.web3isgoinggreat.com/single/lick-theft","name":"Web3 Is Going Great: Thief of millions in seized U.S.-controlled crypto alleged to be government crypto contractor's son","type":"research","credibility":2},{"url":"https://cointelegraph.com/news/us-treasury-theft-wallet-bundled-memecoin-crashes-97","name":"Cointelegraph: US Treasury theft wallet-bundled memecoin crashes 97%","type":"news_article","credibility":2},{"url":"https://cryptopotato.com/bubblemaps-flags-lick-token-as-on-chain-data-ties-launch-to-alleged-40m-us-government-theft/","name":"CryptoPotato: Bubblemaps flags LICK token as on-chain data ties launch to alleged $40M US government theft","type":"news_article","credibility":2},{"url":"https://lamag.com/crimeinla/nepo-baby-whose-dad-manages-seized-assets-for-us-marshals-busted-on-ritzy-island/","name":"LA Magazine: Nepo baby whose dad manages seized assets for US Marshals busted on ritzy island","type":"news_article","credibility":2},{"url":"https://phemex.com/news/article/french-court-reviews-extradition-of-american-accused-of-46m-crypto-theft-84748","name":"Phemex: French court reviews extradition of American accused of $46M crypto theft","type":"news_article","credibility":2},{"url":"https://ground.news/article/guadeloupe-an-american-suspected-of-stealing-46-million-in-cryptocurrency-will-be-extradited","name":"Ground News (AFP): Guadeloupe — an American suspected of stealing $46 million in cryptocurrency will be extradited","type":"news_article","credibility":1},{"url":"https://cryptoactu.com/france-extradition-autorisee-vers-etats-unis/","name":"Cryptoactu: France — extradition autorisée vers les États-Unis","type":"news_article","credibility":2}],"source_tags":[],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-code-investigator","created_at":"2026-08-01T17:04:59.631839+00:00","updated_at":"2026-10-27T21:01:29.642+00:00"},"source_quality":{"total":12,"tier1":0,"tier2":5,"tier3":0,"unrated":7},"follower_count":null,"content_updated_at":"2026-10-27T21:01:30.224Z","last_fact_checked_at":"2026-08-26T17:07:50.526Z","fact_check_next_allowed_at":null,"update_next_allowed_at":"2026-11-03T21:01:39.346Z"}