{"investigation":{"slug":"us-government-crypto-wallet","entity_name":"US Government Crypto Wallet","trust_score":10,"severity_base":null,"score_modifier":0,"confidence":1,"status":"published","content_type":"investigation","summary":"The US government holds one of the largest concentrations of seized cryptocurrency in the world, accumulated through major law enforcement actions including the 2016 Bitfinex hack and the Silk Road darknet marketplace. In October 2024, a government-controlled wallet linked to Bitfinex seizure funds was drained of approximately $20 million in what was subsequently attributed to alleged insider theft by John Daghita, son of a US Marshals Service contractor, who was arrested in Saint Martin in March 2026 after a blockchain investigation by ZachXBT exposed the scheme.","sections":[{"content":"The United States government, primarily through the Department of Justice (DOJ) and the US Marshals Service (USMS), has accumulated significant cryptocurrency holdings through criminal forfeiture and civil asset seizures. The two largest sources of these holdings are funds seized from the 2016 Bitfinex hack and assets confiscated from the Silk Road darknet marketplace. In August 2016, Ilya Lichtenstein hacked the Bitfinex exchange and stole 119,754 Bitcoin, then worth approximately $72 million. The US government recovered approximately 95,000 of those Bitcoin in February 2022 when investigators decrypted a file containing wallet private keys. Lichtenstein and his wife Heather Morgan both pleaded guilty in August 2023; Lichtenstein was sentenced to five years in prison in November 2024 and Morgan received 18 months. Separately, the Silk Road marketplace, shut down in 2013, resulted in the seizure of approximately 170,000 Bitcoin from founder Ross Ulbricht and platform servers. An additional 69,370 Bitcoin, linked to an unidentified 'Individual X' hacker, were seized in November 2020 and were the subject of protracted litigation that concluded in January 2025 when a federal court authorized their sale. A June 2022 DOJ Office of Inspector General (OIG) audit covering fiscal years 2017 through 2021 found significant management deficiencies in how the USMS tracked and secured its cryptocurrency holdings. The OIG found that the USMS relied on supplemental spreadsheets lacking documented operating procedures and contained inaccuracies, rather than using the DOJ's official asset tracking system, and that the agency lacked adequate policies on cryptocurrency storage, valuation, and disposal.","heading":"Background","sources":[{"url":"https://www.justice.gov/archives/opa/pr/bitfinex-hacker-sentenced-money-laundering-conspiracy-involving-billions-stolen","name":"","type":"other","credibility":3},{"url":"https://en.wikipedia.org/wiki/2016_Bitfinex_hack","name":"","type":"other","credibility":3},{"url":"https://oig.justice.gov/news/doj-oig-releases-report-us-marshals-services-management-seized-cryptocurrency","name":"","type":"other","credibility":3},{"url":"https://fortune.com/crypto/2025/01/09/federal-government-allowed-sell-bitcoin-silk-road-courts/","name":"","type":"other","credibility":3},{"url":"https://www.cnbc.com/2020/11/05/1-billion-worth-of-bitcoin-linked-to-the-silk-road-seized-by-the-us.html","name":"","type":"other","credibility":3}],"severity":"medium"},{"content":"US government-controlled cryptocurrency wallets have generated significant market attention through large, on-chain movements. In February 2024, the US government transferred approximately $922 million worth of Bitcoin from wallets holding Bitfinex-seized funds, with Arkham Intelligence identifying at least three distinct government wallets tagged as holding those assets. In January 2025, a US District Court in the Northern District of California authorized the sale of the 69,370 Bitcoin seized from Silk Road's 'Individual X,' clearing the way for what would be one of the largest government crypto liquidations on record. The government has historically used Coinbase as a liquidation venue; in June 2023, officials sold approximately 10,000 Bitcoin from Silk Road seizures for roughly $215 million. In April 2025, a further 1,999 Bitcoin — approximately $130 million — was moved to a Coinbase-linked wallet as part of an announced sale. The USMS has simultaneously been unable to provide precise estimates of total crypto under custody; a February 2025 report indicated the agency could not confirm its full holdings despite Arkham Intelligence estimating government-controlled wallets held approximately $22 billion in assets at the time.","heading":"Notable Fund Movements","sources":[{"url":"https://www.theblock.co/post/279733/us-government-initiates-around-922-million-in-bitcoin-transfers-from-seized-bitfinex-hack-funds","name":"","type":"other","credibility":3},{"url":"https://decrypt.co/300133/us-court-greenlights-sale-of-6-5b-in-seized-silk-road-bitcoin","name":"","type":"other","credibility":3},{"url":"https://cryptoslate.com/us-government-moves-30175-bitcoin-confiscated-from-silk-road-to-coinbase/","name":"","type":"other","credibility":3},{"url":"https://www.coindesk.com/policy/2025/02/20/u-s-marshals-service-managing-seized-assets-can-t-say-how-much-crypto-it-holds","name":"","type":"other","credibility":3}],"severity":"medium"},{"content":"On October 24, 2024, a government-controlled Ethereum wallet holding assets seized in connection with the 2016 Bitfinex hack was drained of approximately $20 million in cryptocurrency. Arkham Intelligence first identified the suspicious outflows. The funds comprised approximately $13.7 million in aUSDC (Aave interest-bearing USDC), $5.5 million in USDC, $1.25 million in USDT, and approximately $446,000 in Ethereum. The attacker withdrew the funds from the Aave lending protocol and transferred them to a newly-created wallet address beginning with '0x348,' created less than five days prior to the incident, before routing the funds through the 1inch exchange aggregator and dispersing Ethereum in $40,000 increments to exchange deposit addresses. The government-linked wallet was left holding only $127 worth of a Donald Trump-themed meme coin. Most funds were allegedly returned after FBI outreach, but approximately $700,000 routed through instant exchanges was not recovered. In January 2026, blockchain investigator ZachXBT published findings alleging that an individual using the online handles 'John' and 'Lick' — later identified as John Daghita — had been responsible for these movements. ZachXBT's investigation was reportedly triggered by a recorded Telegram dispute in which the individual inadvertently demonstrated real-time access to and control over large sums in wallets linked to government seizures, including showing a Tron address holding approximately $2.3 million and then transferring approximately $6.7 million in Ether live during the exchange. ZachXBT estimated approximately $23 million in USMS-linked wallet movements traceable to Daghita, with a broader estimate of over $90 million in total suspected theft activity when accounting for late 2025 wallet behavior.","heading":"The January 2025 / October 2024 Drain Incident","sources":[{"url":"https://decrypt.co/288151/us-government-crypto-wallet-drained-20-million","name":"","type":"other","credibility":3},{"url":"https://cointelegraph.com/news/us-government-crypto-hacked-arkham-intelligence","name":"","type":"other","credibility":3},{"url":"https://www.theblock.co/post/386945/individual-behind-40-million-government-wallet-theft-is-son-of-seized-crypto-contractor-executive-zachxbt","name":"","type":"other","credibility":3},{"url":"https://www.coindesk.com/business/2026/01/26/u-s-marshals-investigate-claims-that-son-of-government-contractor-stole-usd40-million-of-seized-crypto","name":"","type":"other","credibility":3},{"url":"https://www.trmlabs.com/resources/blog/zachxbt-uncovers-crypto-theft-network-linked-to-us-government-seizure-funds","name":"","type":"other","credibility":3}],"severity":"medium"},{"content":"On-chain analysis linked the October 2024 wallet drain to addresses that Arkham Intelligence had previously tagged as US government-controlled, including wallets known to hold assets from the 2016 Bitfinex seizure. ZachXBT's subsequent investigation traced the stolen funds through a network of wallets and identified consolidation points, including one wallet holding 12,540 Ether worth approximately $36 million at prevailing prices. The alleged theft became possible, according to ZachXBT and subsequent reporting, due to the access granted to Command Services and Support (CMDSS), a Virginia-based technology firm that received a USMS contract in October 2024 — the same month as the drain — to assist with the custody and disposition of certain categories of seized cryptocurrency. CMDSS received two contracts totaling approximately $7.8 million from 2024 through 2026. Dean Daghita, president and chief executive of CMDSS, is the father of John Daghita, the individual ZachXBT identified as 'Lick.' John Daghita allegedly exploited his access to USMS-managed wallet infrastructure through his father's company. After ZachXBT published his investigation in January 2026, Daghita allegedly taunted him by sending small dust amounts of stolen funds to ZachXBT's public wallet address — a maneuver that may have assisted investigators. The Washington Monthly reported in February 2026 that the USMS had been managing approximately $22 billion in seized crypto assets using spreadsheets with known inaccuracies, underscoring systemic custody weaknesses that allegedly facilitated the theft.","heading":"On-Chain Evidence and the CMDSS Contractor Connection","sources":[{"url":"https://www.trmlabs.com/resources/blog/john-daghita-aka-john-lick-arrested-in-alleged-cryptocurrency-theft-tied-to-us-marshals-service","name":"","type":"other","credibility":3},{"url":"https://www.bleepingcomputer.com/news/security/fbi-arrests-suspect-linked-to-46m-crypto-theft-from-us-marshals/","name":"","type":"other","credibility":3},{"url":"https://www.ccn.com/news/crypto/us-bitcoin-insider-theft-zachxbt/","name":"","type":"other","credibility":3},{"url":"https://washingtonmonthly.com/2026/02/19/cryptocurrency-government-custody/","name":"","type":"other","credibility":3},{"url":"https://oig.justice.gov/sites/default/files/reports/22-082.pdf","name":"","type":"other","credibility":3}],"severity":"medium"},{"content":"The US government's seized cryptocurrency holdings represent a unique and complex risk profile. The wallets themselves are not operated as a user-facing financial product, but their security failures have direct implications for the integrity of law enforcement processes and the safety of assets held on behalf of victims and the public. The CMDSS incident exposed that contractor vetting, access control, and monitoring of privileged wallets were materially inadequate: a single insider allegedly accessed and drained tens of millions of dollars from multiple wallets over a period of months without triggering automated alerts. Systemic deficiencies identified in the 2022 OIG audit — including reliance on inaccurate spreadsheets, absence of formal custody policies, and lack of proper outsourcing frameworks — were not remediated before CMDSS was awarded its contract. ZachXBT's estimate that total suspicious activity could exceed $90 million, and the CCN report noting over 300,000 Bitcoin (worth tens of billions at time of reporting) potentially at risk from similar custody failures, indicates the scale of exposure. The court-ordered return of Bitfinex-seized Bitcoin to Bitfinex further complicates the risk picture by requiring the government to demonstrate that returned assets have not been compromised. John Daghita's arrest in March 2026 was described by ZachXBT as a direct result of the blockchain investigation, marking one of the first major cases where on-chain forensics by an independent investigator led directly to a federal arrest.","heading":"Risk Assessment","sources":[{"url":"https://bitcoinmagazine.com/news/us-investigating-40-million-crypto-theft","name":"","type":"other","credibility":3},{"url":"https://www.coindesk.com/business/2026/03/05/son-of-u-s-government-contractor-accused-of-stealing-millions-in-seized-crypto-arrested-in-france","name":"","type":"other","credibility":3},{"url":"https://www.cbsnews.com/news/federal-contractor-who-allegedly-stole-46-million-in-crypto-arrested-in-caribbean-fbi-says/","name":"","type":"other","credibility":3},{"url":"https://www.bloomberg.com/news/articles/2026-03-05/fbi-arrests-contractor-in-alleged-crypto-theft-held-by-marshals","name":"","type":"other","credibility":3},{"url":"https://www.panewslab.com/en/articles/019cbe99-295b-7256-9788-8fb5ae08167e","name":"","type":"other","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2016-08-02","event":"Bitfinex exchange hacked; 119,754 Bitcoin stolen by Ilya Lichtenstein","source":""},{"date":"2013-10-02","event":"FBI shuts down Silk Road; approximately 170,000 Bitcoin seized from Ross Ulbricht and platform servers","source":""},{"date":"2020-11-03","event":"US government seizes 69,370 Bitcoin linked to Silk Road 'Individual X' hacker, then worth approximately $1 billion","source":""},{"date":"2022-02-08","event":"DOJ recovers approximately 95,000 Bitcoin from Bitfinex hack by decrypting Lichtenstein's wallet key file; Lichtenstein and Heather Morgan arrested","source":""},{"date":"2022-06-14","event":"DOJ OIG releases audit finding the USMS relied on inaccurate spreadsheets and lacked adequate policies for seized crypto management","source":""},{"date":"2023-08-03","event":"Lichtenstein and Morgan plead guilty to money laundering conspiracy","source":""},{"date":"2024-02-28","event":"US government transfers approximately $922 million in Bitcoin from Bitfinex-seized wallets; Arkham identifies wallets on-chain","source":""},{"date":"2024-10","event":"CMDSS, run by Dean Daghita, awarded USMS contract to manage and dispose of seized cryptocurrency","source":"","date_original":"2024-10-01"},{"date":"2024-10-24","event":"Approximately $20 million drained from US government Ethereum wallet holding Bitfinex-seized assets; Arkham Intelligence reports incident; most funds allegedly returned after FBI outreach, roughly $700,000 permanently lost","source":""},{"date":"2024-11-14","event":"Ilya Lichtenstein sentenced to five years; Heather Morgan sentenced to 18 months","source":""},{"date":"2025-01-09","event":"Federal court authorizes US government to sell 69,370 Silk Road Bitcoin, valued at approximately $6.5 billion","source":""},{"date":"2025-01-23","event":"ZachXBT observes a recorded Telegram dispute in which handle 'Lick' demonstrates live access to wallets containing large sums linked to government seizures","source":""},{"date":"2026-01-25","event":"ZachXBT publishes investigation publicly identifying 'Lick' as the individual behind alleged $40+ million theft from USMS-linked wallets; traces funds to CMDSS contractor connection","source":""},{"date":"2026-01-26","event":"US Marshals Service confirms it is investigating allegations; CoinDesk and The Block report USMS inquiry","source":""},{"date":"2026-02-19","event":"Washington Monthly publishes investigation into USMS's reliance on spreadsheets to manage approximately $22 billion in seized crypto, citing systemic custody failures","source":""},{"date":"2026-03-05","event":"John Daghita arrested on the island of Saint Martin by French Gendarmerie elite tactical unit in coordination with FBI Washington Field Office; hardware wallets, USB drives, and US currency seized","source":""},{"date":"2026-03-06","event":"FBI Director Kash Patel announces arrest; Daghita accused of stealing more than $46 million in cryptocurrency from the USMS; ZachXBT states the arrest resulted directly from his blockchain investigation","source":""}],"sources_used":[{"url":"https://www.justice.gov/archives/opa/pr/bitfinex-hacker-sentenced-money-laundering-conspiracy-involving-billions-stolen","name":"","type":"other","archive_url":"http://web.archive.org/web/20260524104909/https://www.justice.gov/archives/opa/pr/bitfinex-hacker-sentenced-money-laundering-conspiracy-involving-billions-stolen","credibility":3,"archive_timestamp":"2026-05-24T10:49:09+00:00"},{"url":"https://en.wikipedia.org/wiki/2016_Bitfinex_hack","name":"","type":"other","archive_url":"http://web.archive.org/web/20260716173538/https://en.wikipedia.org/wiki/2016_Bitfinex_hack","credibility":3,"archive_timestamp":"2026-07-16T17:35:38+00:00"},{"url":"https://oig.justice.gov/news/doj-oig-releases-report-us-marshals-services-management-seized-cryptocurrency","name":"","type":"other","archive_url":"http://web.archive.org/web/20260628023708/https://oig.justice.gov/news/doj-oig-releases-report-us-marshals-services-management-seized-cryptocurrency","credibility":3,"archive_timestamp":"2026-06-28T02:37:08+00:00"},{"url":"https://fortune.com/crypto/2025/01/09/federal-government-allowed-sell-bitcoin-silk-road-courts/","name":"","type":"other","archive_url":"http://web.archive.org/web/20260824203055/https://fortune.com/crypto/2025/01/09/federal-government-allowed-sell-bitcoin-silk-road-courts/","credibility":3,"archive_timestamp":"2026-08-24T20:30:55+00:00"},{"url":"https://www.cnbc.com/2020/11/05/1-billion-worth-of-bitcoin-linked-to-the-silk-road-seized-by-the-us.html","name":"","type":"other","archive_url":"http://web.archive.org/web/20260713183556/https://www.cnbc.com/2020/11/05/1-billion-worth-of-bitcoin-linked-to-the-silk-road-seized-by-the-us.html","credibility":3,"archive_timestamp":"2026-07-13T18:35:56+00:00"},{"url":"https://www.theblock.co/post/279733/us-government-initiates-around-922-million-in-bitcoin-transfers-from-seized-bitfinex-hack-funds","name":"","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://decrypt.co/300133/us-court-greenlights-sale-of-6-5b-in-seized-silk-road-bitcoin","name":"","type":"other","archive_url":"http://web.archive.org/web/20260313233543/https://decrypt.co/300133/us-court-greenlights-sale-of-6-5b-in-seized-silk-road-bitcoin","credibility":3,"archive_timestamp":"2026-03-13T23:35:43+00:00"},{"url":"https://cryptoslate.com/us-government-moves-30175-bitcoin-confiscated-from-silk-road-to-coinbase/","name":"","type":"other","archive_url":"http://web.archive.org/web/20260419112125/https://cryptoslate.com/us-government-moves-30175-bitcoin-confiscated-from-silk-road-to-coinbase/","credibility":3,"archive_timestamp":"2026-04-19T11:21:25+00:00"},{"url":"https://www.coindesk.com/policy/2025/02/20/u-s-marshals-service-managing-seized-assets-can-t-say-how-much-crypto-it-holds","name":"","type":"other","archive_url":"http://web.archive.org/web/20260305214840/https://www.coindesk.com/policy/2025/02/20/u-s-marshals-service-managing-seized-assets-can-t-say-how-much-crypto-it-holds","credibility":3,"archive_timestamp":"2026-03-05T21:48:40+00:00"},{"url":"https://decrypt.co/288151/us-government-crypto-wallet-drained-20-million","name":"","type":"other","archive_url":"http://web.archive.org/web/20260513042356/https://decrypt.co/288151/us-government-crypto-wallet-drained-20-million","credibility":3,"archive_timestamp":"2026-05-13T04:23:56+00:00"},{"url":"https://cointelegraph.com/news/us-government-crypto-hacked-arkham-intelligence","name":"","type":"other","archive_url":"http://web.archive.org/web/20260412083604/https://cointelegraph.com/news/us-government-crypto-hacked-arkham-intelligence","credibility":3,"archive_timestamp":"2026-04-12T08:36:04+00:00"},{"url":"https://www.theblock.co/post/386945/individual-behind-40-million-government-wallet-theft-is-son-of-seized-crypto-contractor-executive-zachxbt","name":"","type":"other","archive_url":"http://web.archive.org/web/20260526201332/https://www.theblock.co/post/386945/individual-behind-40-million-government-wallet-theft-is-son-of-seized-crypto-contractor-executive-zachxbt","credibility":3,"archive_timestamp":"2026-05-26T20:13:32+00:00"},{"url":"https://www.coindesk.com/business/2026/01/26/u-s-marshals-investigate-claims-that-son-of-government-contractor-stole-usd40-million-of-seized-crypto","name":"","type":"other","archive_url":"http://web.archive.org/web/20260809184754/https://www.coindesk.com/business/2026/01/26/u-s-marshals-investigate-claims-that-son-of-government-contractor-stole-usd40-million-of-seized-crypto","credibility":3,"archive_timestamp":"2026-08-09T18:47:54+00:00"},{"url":"https://www.trmlabs.com/resources/blog/zachxbt-uncovers-crypto-theft-network-linked-to-us-government-seizure-funds","name":"","type":"other","archive_url":"http://web.archive.org/web/20260526201333/https://www.trmlabs.com/resources/blog/zachxbt-uncovers-crypto-theft-network-linked-to-us-government-seizure-funds","credibility":3,"archive_timestamp":"2026-05-26T20:13:33+00:00"},{"url":"https://www.trmlabs.com/resources/blog/john-daghita-aka-john-lick-arrested-in-alleged-cryptocurrency-theft-tied-to-us-marshals-service","name":"","type":"other","archive_url":"http://web.archive.org/web/20260505054352/https://www.trmlabs.com/resources/blog/john-daghita-aka-john-lick-arrested-in-alleged-cryptocurrency-theft-tied-to-us-marshals-service","credibility":3,"archive_timestamp":"2026-05-05T05:43:52+00:00"},{"url":"https://www.bleepingcomputer.com/news/security/fbi-arrests-suspect-linked-to-46m-crypto-theft-from-us-marshals/","name":"","type":"other","archive_url":"http://web.archive.org/web/20260819174144/https://www.bleepingcomputer.com/news/security/fbi-arrests-suspect-linked-to-46m-crypto-theft-from-us-marshals/","credibility":3,"archive_timestamp":"2026-08-19T17:41:44+00:00"},{"url":"https://www.ccn.com/news/crypto/us-bitcoin-insider-theft-zachxbt/","name":"","type":"other","archive_url":"http://web.archive.org/web/20260130105404/https://www.ccn.com/news/crypto/us-bitcoin-insider-theft-zachxbt/","credibility":3,"archive_timestamp":"2026-01-30T10:54:04+00:00"},{"url":"https://washingtonmonthly.com/2026/02/19/cryptocurrency-government-custody/","name":"","type":"other","archive_url":"http://web.archive.org/web/20260303100321/https://washingtonmonthly.com/2026/02/19/cryptocurrency-government-custody/","credibility":3,"archive_timestamp":"2026-03-03T10:03:21+00:00"},{"url":"https://oig.justice.gov/sites/default/files/reports/22-082.pdf","name":"","type":"other","archive_url":"http://web.archive.org/web/20260628031508/https://oig.justice.gov/sites/default/files/reports/22-082.pdf","credibility":3,"archive_timestamp":"2026-06-28T03:15:08+00:00"},{"url":"https://bitcoinmagazine.com/news/us-investigating-40-million-crypto-theft","name":"","type":"other","archive_url":"http://web.archive.org/web/20260605232407/https://bitcoinmagazine.com/news/us-investigating-40-million-crypto-theft","credibility":3,"archive_timestamp":"2026-06-05T23:24:07+00:00"},{"url":"https://www.coindesk.com/business/2026/03/05/son-of-u-s-government-contractor-accused-of-stealing-millions-in-seized-crypto-arrested-in-france","name":"","type":"other","archive_url":"http://web.archive.org/web/20260809184724/https://www.coindesk.com/business/2026/03/05/son-of-u-s-government-contractor-accused-of-stealing-millions-in-seized-crypto-arrested-in-france","credibility":3,"archive_timestamp":"2026-08-09T18:47:24+00:00"},{"url":"https://www.cbsnews.com/news/federal-contractor-who-allegedly-stole-46-million-in-crypto-arrested-in-caribbean-fbi-says/","name":"","type":"other","archive_url":"http://web.archive.org/web/20260417102155/https://www.cbsnews.com/news/federal-contractor-who-allegedly-stole-46-million-in-crypto-arrested-in-caribbean-fbi-says/","credibility":3,"archive_timestamp":"2026-04-17T10:21:55+00:00"},{"url":"https://www.bloomberg.com/news/articles/2026-03-05/fbi-arrests-contractor-in-alleged-crypto-theft-held-by-marshals","name":"","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://www.panewslab.com/en/articles/019cbe99-295b-7256-9788-8fb5ae08167e","name":"","type":"other","archive_url":"https://web.archive.org/web/20260829152713/https://panews.io/articles/019cbe99-295b-7256-9788-8fb5ae08167e","credibility":3,"archive_timestamp":"2026-08-29T15:27:13+00:00"}],"source_tags":["defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-04T02:54:28.254652+00:00","updated_at":"2026-08-30T01:16:24.768232+00:00"}}