Audit log

Every state-changing event for John Daghita (aka Lick) — US Marshals Crypto Theft: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-08-01 17:05:29Z
   Score: ? → ? (no score change)
   anchorpending

   chain

   ●—

   hash

   4FqVogcExXFK…U5ArVi6gcopysha256 → base58

   verifying row…

   canonical bytes (24482 B) ▸

   {"actor":"system:backfill","investigation_id":"9d1c3851-93aa-49f3-b9f9-bf72fd0ffcfc","kind":"publish","page_slug":"john-daghita-aka-lick-us-marshals-crypto-theft","published_at":"2026-08-01T17:05:29.324Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"John Daghita (aka Lick) — US Marshals Crypto Theft","sections":[{"content":"John Daghita is the son of Dean Daghita, president and chief executive of Command Services & Support (CMDSS), a Haymarket, Virginia-based IT firm. In October 2024, CMDSS was awarded a contract valued at approximately $4 million by the U.S. Marshals Service to assist with the custody and disposal of so-called 'Class 2-4' seized digital assets — cryptocurrency types not supported by mainstream centralized exchanges. This contract gave CMDSS privileged access to cryptographic keys and wallets holding assets seized by federal law enforcement during criminal prosecutions. According to the federal indictment filed March 26, 2026, in the Eastern District of Virginia, John Daghita was hired by the CMDSS-affiliated firm as a 'Cryptocurrency Subject Matter Expert,' giving him direct operational access to the government-linked custodial wallets. Prosecutors allege he leveraged this access to steal government-held cryptocurrency for personal enrichment.","heading":"Background and Alleged Access Vector","severity":"critical","sources":[{"credibility":2,"name":"Son of contractor managing seized crypto for U.S. Marshals arrested in France over alleged $46m theft — CoinDesk","type":"news_article","url":"https://www.coindesk.com/business/2026/03/05/son-of-u-s-government-contractor-accused-of-stealing-millions-in-seized-crypto-arrested-in-france"},{"credibility":2,"name":"John Daghita aka John/Lick Arrested in Alleged Cryptocurrency Theft Tied to US Marshals Service — TRM Labs","type":"research","url":"https://www.trmlabs.com/resources/blog/john-daghita-aka-john-lick-arrested-in-alleged-cryptocurrency-theft-tied-to-us-marshals-service"},{"credibility":1,"name":"FBI Arrests U.S. Contractor's Son In $46 Million Crypto Theft — Forbes","type":"news_article","url":"https://www.forbes.com/sites/digital-assets/2026/03/05/fbi-arrests-us-contractors-son-in-46-million-crypto-theft/"}]},{"content":"According to the federal indictment and blockchain analysis by TRM Labs and ZachXBT, the alleged theft unfolded in two primary phases. On December 15, 2025, Daghita allegedly initiated three transfers totaling approximately $5 million from USMS-controlled wallets to addresses he personally controlled. A second and larger wave occurred on January 22 and 23, 2026, during which an additional $41 million was moved. Prosecutors note that on January 22, the USMS instructed CMDSS to return approximately $2 million in virtual currency to a USMS-owned address; approximately 20 minutes later, Daghita allegedly diverted those assets to a non-USMS address instead. On-chain analysis by ZachXBT traced wallet address 0xc7a2, which allegedly received $24.9 million in March 2024 from a U.S. government address tied to the 2016 Bitfinex hack seizure. Over $90 million in total suspicious inflows were linked to wallets attributed to the 'John/Lick' persona across Ethereum and TRON networks, including funds traced back to government-controlled Bitfinex seizure addresses. After public exposure in late January 2026, the alleged perpetrator moved funds through mixers and across blockchains in an apparent effort to obscure origin and ownership.","heading":"The Alleged Theft: On-Chain Activity","severity":"critical","sources":[{"credibility":2,"name":"A crypto flex gone wrong exposes $90 million wallet tied to U.S. government seizure — CoinDesk","type":"news_article","url":"https://www.coindesk.com/business/2026/01/23/a-crypto-flex-gone-wrong-exposes-usd90-million-wallet-tied-to-u-s-government-seizure"},{"credibility":2,"name":"ZachXBT Uncovers Crypto Theft Network Linked to US Government Seizure Funds — TRM Labs","type":"research","url":"https://www.trmlabs.com/resources/blog/zachxbt-uncovers-crypto-theft-network-linked-to-us-government-seizure-funds"},{"credibility":2,"name":"Individual behind $40 million government wallet theft is son of seized-crypto contractor executive: ZachXBT — The Block","type":"news_article","url":"https://www.theblock.co/post/386945/individual-behind-40-million-government-wallet-theft-is-son-of-seized-crypto-contractor-executive-zachxbt"}]},{"content":"The alleged theft was not initially uncovered by federal investigators but by pseudonymous blockchain investigator ZachXBT. In late January 2026, ZachXBT observed a recorded 'band-for-band' exchange — a practice in online cybercrime communities in which participants prove wealth by screen-sharing wallet balances and moving funds in real time. During the exchange, the participant operating under the 'John' or 'Lick' handle displayed an Exodus wallet showing a TRON address holding approximately $2.3 million, then transferred an additional $6.7 million in Ether live into an Ethereum address, and consolidated roughly $23 million into a single wallet (identified as 0xd8bc) over the course of the dispute. ZachXBT traced these wallet addresses backward through the blockchain, ultimately linking them to U.S. government Bitfinex seizure wallets, and publicly identified the individual as John Daghita based on identifiers shared in the recorded session. ZachXBT's findings were reported to law enforcement, after which the U.S. Marshals Service opened a formal investigation.","heading":"Discovery: The Band-for-Band Incident","severity":"high","sources":[{"credibility":2,"name":"A crypto flex gone wrong exposes $90 million wallet tied to U.S. government seizure — CoinDesk","type":"news_article","url":"https://www.coindesk.com/business/2026/01/23/a-crypto-flex-gone-wrong-exposes-usd90-million-wallet-tied-to-u-s-government-seizure"},{"credibility":2,"name":"U.S. marshals investigate claim of $40 million crypto theft by son of federal crypto custodian — CoinDesk","type":"news_article","url":"https://www.coindesk.com/business/2026/01/26/u-s-marshals-investigate-claims-that-son-of-government-contractor-stole-usd40-million-of-seized-crypto"},{"credibility":2,"name":"ZachXBT Alleges Son of US Government Crypto Custodian CEO Behind Wallet Theft — CryptoNews","type":"news_article","url":"https://cryptonews.com/news/zachxbt-alleges-son-of-us-government-crypto-custodian-ceo-behind-wallet-theft/"}]},{"content":"Shortly after ZachXBT's public disclosure in late January 2026, a wallet linked to the alleged theft deployed a Solana-based meme coin called $LICK on the Pump.fun launchpad. On-chain analysis by Bubblemaps showed that the deployer wallet retained approximately 40% of the total token supply. The token was promoted via Telegram livestreams. It lost approximately 97% of its value within its first day of trading. Pump.fun subsequently delisted the $LICK ticker. The token's launch drew additional scrutiny from blockchain analysts and law enforcement as further evidence connecting Daghita's online identity to the alleged theft.","heading":"The $LICK Meme Token","severity":"high","sources":[{"credibility":2,"name":"US Crypto Theft Wallet Launches Solana Meme Coin — Why PumpFun Deleted $LICK — Yahoo Finance","type":"news_article","url":"https://finance.yahoo.com/news/us-crypto-theft-wallet-launches-121457700.html"},{"credibility":2,"name":"Bubblemaps Flags LICK Token as On-Chain Data Ties Launch to Alleged $40M US Government Theft — CryptoPotato","type":"news_article","url":"https://cryptopotato.com/bubblemaps-flags-lick-token-as-on-chain-data-ties-launch-to-alleged-40m-us-government-theft/"}]},{"content":"On the night of March 4, 2026, French Gendarmerie officers — reported to be from an elite tactical unit — arrested John Daghita at Villa Sun Reset on the island of Saint Martin, a French Caribbean territory. The operation was conducted in collaboration with the FBI Washington Field Office, with support from the FBI Cleveland Field Office. FBI Director Kash Patel publicly announced the arrest via a post on X (formerly Twitter) and shared images including Daghita in handcuffs and a metal suitcase reportedly containing $239,348 in cash, a Rolex GMT Master watch, and multiple hardware wallets alleged to contain stolen U.S. government cryptocurrency. U.S. authorities subsequently sought extradition.","heading":"Arrest","severity":"critical","sources":[{"credibility":1,"name":"FBI Washington Field Office arrest announcement — X (FBI WFO)","type":"official","url":"https://x.com/FBIWFO/status/2029678454694642051"},{"credibility":1,"name":"US government contractor accused of stealing $46M arrested on small island, FBI announces — Fox News","type":"news_article","url":"https://www.foxnews.com/us/us-government-contractor-accused-stealing-46m-arrested-small-island-fbi-announces"},{"credibility":2,"name":"FBI arrests crypto thief accused of stealing $46 million from seized government wallets — Tom's Hardware","type":"news_article","url":"https://www.tomshardware.com/tech-industry/cryptocurrency/fbi-arrests-crypto-thief-accused-of-stealing-usd46-million-from-seized-government-wallets-suspects-father-was-allegedly-contractor-for-the-us-marshals"}]},{"content":"On March 26, 2026, a federal grand jury in Alexandria, Virginia, returned a 15-count indictment against John Daghita in the Eastern District of Virginia. The charges include wire fraud, theft of public money, money laundering, and unlawful monetary transactions. The indictment alleges Daghita stole more than $46 million in virtual currency between December 15, 2025, and January 23, 2026. The period encompasses the dates shortly after Daghita turned 21. At the time of writing, Daghita had not entered a plea in U.S. federal court, as extradition proceedings were still ongoing.","heading":"Federal Indictment","severity":"critical","sources":[{"credibility":2,"name":"Mike Levine on X — indictment announcement with charge detail","type":"news_article","url":"https://x.com/MLevineReports/status/2037614378577433076?lang=en"},{"credibility":2,"name":"Federal Contractor's Son Arrested, Charged With Stealing $46 Million From US Crypto Stockpile — Decrypt","type":"news_article","url":"https://decrypt.co/360120/federal-contractors-son-arrested-charged-with-stealing-46-million-from-us-crypto-stockpile"},{"credibility":2,"name":"FBI arrests suspect linked to $46M crypto theft from US Marshals — BleepingComputer","type":"news_article","url":"https://www.bleepingcomputer.com/news/security/fbi-arrests-suspect-linked-to-46m-crypto-theft-from-us-marshals/"}]},{"content":"Following his arrest in Saint Martin, Daghita was held at Basse-Terre prison in Guadeloupe pending extradition review by French judicial authorities. On May 21, 2026, Daghita appeared before the indictment chamber of the Court of Appeal in Basse-Terre; the magistrates reserved their decision until May 28. Notably, Daghita reportedly requested his own extradition at the May 21 hearing, stating he wished to explain himself before U.S. courts. The Basse-Terre Court of Appeal subsequently approved the extradition request, validating the transfer of Daghita to U.S. federal custody. As of the date of this investigation (August 2026), his precise extradition transfer status had not been confirmed in available public sources.","heading":"Extradition Proceedings","severity":"high","sources":[{"credibility":2,"name":"John Lick Daghita Extradition Approved In $46M US Marshals Crypto Case — CryptoAdventure","type":"news_article","url":"https://cryptoadventure.com/john-lick-daghita-extradition-approved-in-46m-us-marshals-crypto-case/"},{"credibility":2,"name":"French Court Reviews Extradition of American in $46M Crypto — Phemex News","type":"news_article","url":"https://phemex.com/news/article/french-court-reviews-extradition-of-american-accused-of-46m-crypto-theft-84748"},{"credibility":3,"name":"Dark Web Informer on X — Basse-Terre court appearance detail","type":"social_media","url":"https://x.com/DarkWebInformer/status/2057966552801046818?lang=en"}]},{"content":"Investigative reporting by Forbes and others identified broader structural failures that enabled the alleged theft. The U.S. Marshals Service cryptocurrency custody procurement process reportedly underwent four restarts before the CMDSS contract was awarded in October 2024. Inspector General warnings about vulnerabilities in the custody chain were allegedly ignored. The CMDSS contract gave a single small firm exclusive access to wallets collectively holding billions of dollars in government-seized digital assets. The case also demonstrated that the theft was not detected by federal monitoring systems but was instead exposed by a pseudonymous third-party blockchain investigator responding to an online boast. Analysts have noted that the billions in additional assets held in similar arrangements may remain at risk absent systemic reform of government crypto custody practices.","heading":"Systemic Oversight Failures","severity":"high","sources":[{"credibility":1,"name":"A $46 Million Crypto Theft Is Solved. The System That Allowed It Isn't — Forbes","type":"news_article","url":"https://www.forbes.com/sites/digital-assets/2026/04/12/a-46-million-crypto-theft-is-solved-the-system-that-allowed-it-isnt/"},{"credibility":3,"name":"The $46 Million Crypto Theft Case Against John Daghita Exposes a Government Custody Failure — Anderson Insights","type":"other","url":"https://braedenanderson.com/insights/the-46-million-crypto-theft-case-against-john-daghita-exposes-a-government-custody-failure"}]}],"sources_used":[{"credibility":2,"name":"John Daghita aka John/Lick Arrested in Alleged Cryptocurrency Theft Tied to US Marshals Service — TRM Labs","type":"research","url":"https://www.trmlabs.com/resources/blog/john-daghita-aka-john-lick-arrested-in-alleged-cryptocurrency-theft-tied-to-us-marshals-service"},{"credibility":2,"name":"Son of contractor managing seized crypto for U.S. Marshals arrested in France over alleged $46m theft — CoinDesk","type":"news_article","url":"https://www.coindesk.com/business/2026/03/05/son-of-u-s-government-contractor-accused-of-stealing-millions-in-seized-crypto-arrested-in-france"},{"credibility":2,"name":"A crypto flex gone wrong exposes $90 million wallet tied to U.S. government seizure — CoinDesk","type":"news_article","url":"https://www.coindesk.com/business/2026/01/23/a-crypto-flex-gone-wrong-exposes-usd90-million-wallet-tied-to-u-s-government-seizure"},{"credibility":2,"name":"U.S. marshals investigate claim of $40 million crypto theft by son of federal crypto custodian — CoinDesk","type":"news_article","url":"https://www.coindesk.com/business/2026/01/26/u-s-marshals-investigate-claims-that-son-of-government-contractor-stole-usd40-million-of-seized-crypto"},{"credibility":1,"name":"FBI Arrests U.S. Contractor's Son In $46 Million Crypto Theft — Forbes","type":"news_article","url":"https://www.forbes.com/sites/digital-assets/2026/03/05/fbi-arrests-us-contractors-son-in-46-million-crypto-theft/"},{"credibility":1,"name":"A $46 Million Crypto Theft Is Solved. The System That Allowed It Isn't — Forbes","type":"news_article","url":"https://www.forbes.com/sites/digital-assets/2026/04/12/a-46-million-crypto-theft-is-solved-the-system-that-allowed-it-isnt/"},{"credibility":1,"name":"FBI Washington Field Office arrest announcement — X","type":"official","url":"https://x.com/FBIWFO/status/2029678454694642051"},{"credibility":1,"name":"US government contractor accused of stealing $46M arrested on small island, FBI announces — Fox News","type":"news_article","url":"https://www.foxnews.com/us/us-government-contractor-accused-stealing-46m-arrested-small-island-fbi-announces"},{"credibility":2,"name":"Mike Levine on X — indictment details","type":"news_article","url":"https://x.com/MLevineReports/status/2037614378577433076?lang=en"},{"credibility":2,"name":"Federal Contractor's Son Arrested, Charged With Stealing $46 Million From US Crypto Stockpile — Decrypt","type":"news_article","url":"https://decrypt.co/360120/federal-contractors-son-arrested-charged-with-stealing-46-million-from-us-crypto-stockpile"},{"credibility":2,"name":"Suspect in alleged $46 million US Marshals crypto theft arrested in Saint Martin, FBI says — The Block","type":"news_article","url":"https://www.theblock.co/post/392431/suspect-alleged-46-million-us-marshals-crypto-theft-arrested-saint-martin-fbi"},{"credibility":2,"name":"Individual behind $40 million government wallet theft is son of seized-crypto contractor executive: ZachXBT — The Block","type":"news_article","url":"https://www.theblock.co/post/386945/individual-behind-40-million-government-wallet-theft-is-son-of-seized-crypto-contractor-executive-zachxbt"},{"credibility":2,"name":"ZachXBT Uncovers Crypto Theft Network Linked to US Government Seizure Funds — TRM Labs","type":"research","url":"https://www.trmlabs.com/resources/blog/zachxbt-uncovers-crypto-theft-network-linked-to-us-government-seizure-funds"},{"credibility":2,"name":"FBI arrests suspect linked to $46M crypto theft from US Marshals — BleepingComputer","type":"news_article","url":"https://www.bleepingcomputer.com/news/security/fbi-arrests-suspect-linked-to-46m-crypto-theft-from-us-marshals/"},{"credibility":2,"name":"US Crypto Theft Wallet Launches Solana Meme Coin — Yahoo Finance","type":"news_article","url":"https://finance.yahoo.com/news/us-crypto-theft-wallet-launches-121457700.html"},{"credibility":2,"name":"Bubblemaps Flags LICK Token as On-Chain Data Ties Launch to Alleged $40M US Government Theft — CryptoPotato","type":"news_article","url":"https://cryptopotato.com/bubblemaps-flags-lick-token-as-on-chain-data-ties-launch-to-alleged-40m-us-government-theft/"},{"credibility":2,"name":"John Lick Daghita Extradition Approved In $46M US Marshals Crypto Case — CryptoAdventure","type":"news_article","url":"https://cryptoadventure.com/john-lick-daghita-extradition-approved-in-46m-us-marshals-crypto-case/"},{"credibility":2,"name":"French Court Reviews Extradition of American in $46M Crypto — Phemex News","type":"news_article","url":"https://phemex.com/news/article/french-court-reviews-extradition-of-american-accused-of-46m-crypto-theft-84748"},{"credibility":2,"name":"FBI arrests crypto thief accused of stealing $46 million from seized government wallets — Tom's Hardware","type":"news_article","url":"https://www.tomshardware.com/tech-industry/cryptocurrency/fbi-arrests-crypto-thief-accused-of-stealing-usd46-million-from-seized-government-wallets-suspects-father-was-allegedly-contractor-for-the-us-marshals"},{"credibility":2,"name":"US contractor's son arrested over alleged $46M crypto theft — The Register","type":"news_article","url":"https://www.theregister.com/2026/03/06/contractor_son_crypto_arrest/"},{"credibility":2,"name":"John Daghita Arrested: $46M US Marshals Crypto Theft — Dallas Express","type":"news_article","url":"https://dallasexpress.com/crime/46m-crypto-theft-mystery-how-did-dean-daghitas-21-year-old-son-pull-off-the-heist/"}],"summary":"John Daghita, a 21-year-old Virginia resident known online as 'John' or 'Lick,' was arrested in March 2026 on the Caribbean island of Saint Martin and subsequently indicted on 15 federal counts including wire fraud, theft of government property, and money laundering. He is alleged to have stolen more than $46 million in cryptocurrency from U.S. Marshals Service seizure wallets between December 2025 and January 2026, exploiting access derived from his father Dean Daghita's role as president of CMDSS, a government contractor holding a $4 million USMS custody contract. The case was initially surfaced not by federal investigators but by blockchain investigator ZachXBT after Daghita allegedly exposed his wallet holdings during an online 'band-for-band' dispute.","timeline":[{"date":"2024-03-01","event":"Wallet address 0xc7a2 allegedly received $24.9 million from a U.S. government address tied to the 2016 Bitfinex hack seizure, per ZachXBT on-chain analysis.","source":"CoinDesk — A crypto flex gone wrong","source_url":"https://www.coindesk.com/business/2026/01/23/a-crypto-flex-gone-wrong-exposes-usd90-million-wallet-tied-to-u-s-government-seizure"},{"date":"2024-10-01","event":"CMDSS (Command Services & Support), owned by Dean Daghita, awarded a ~$4 million U.S. Marshals Service contract for custody and disposal of Class 2-4 seized digital assets.","source":"CoinDesk / Forbes","source_url":"https://www.coindesk.com/business/2026/03/05/son-of-u-s-government-contractor-accused-of-stealing-millions-in-seized-crypto-arrested-in-france"},{"date":"2025-12-15","event":"John Daghita allegedly initiates three transfers totaling approximately $5 million from USMS-controlled wallets to wallets he personally controlled — the first alleged theft transactions per the indictment.","source":"Mike Levine on X / Decrypt","source_url":"https://x.com/MLevineReports/status/2037614378577433076?lang=en"},{"date":"2026-01-22","event":"USMS instructs CMDSS to return approximately $2 million in virtual currency to a USMS-owned address. Approximately 20 minutes later, Daghita allegedly diverts the assets to a non-USMS address instead.","source":"Mike Levine on X","source_url":"https://x.com/MLevineReports/status/2037614378577433076?lang=en"},{"date":"2026-01-23","event":"During an online 'band-for-band' exchange, a participant using the handle 'John' or 'Lick' screen-shares wallet balances and moves approximately $23 million live; ZachXBT observes the recorded session and traces the wallets to U.S. government seizure addresses. An additional $41 million in transfers alleged to have occurred on January 22-23.","source":"CoinDesk","source_url":"https://www.coindesk.com/business/2026/01/23/a-crypto-flex-gone-wrong-exposes-usd90-million-wallet-tied-to-u-s-government-seizure"},{"date":"2026-01-26","event":"ZachXBT publishes findings publicly identifying the 'John/Lick' persona as John Daghita and alleging the son of a USMS contractor executive stole more than $40 million in government cryptocurrency. U.S. Marshals Service confirms investigation.","source":"CoinDesk","source_url":"https://www.coindesk.com/business/2026/01/26/u-s-marshals-investigate-claims-that-son-of-government-contractor-stole-usd40-million-of-seized-crypto"},{"date":"2026-01-01","event":"Wallet linked to the alleged theft deploys $LICK meme coin on Pump.fun (Solana). The token collapses approximately 97% within 24 hours. Pump.fun removes the ticker.","source":"Yahoo Finance / CryptoPotato","source_url":"https://finance.yahoo.com/news/us-crypto-theft-wallet-launches-121457700.html"},{"date":"2026-03-04","event":"John Daghita arrested at Villa Sun Reset on the island of Saint Martin by French Gendarmerie elite tactical unit in collaboration with the FBI Washington Field Office. Seized items include $239,348 in cash, a Rolex GMT Master, and multiple hardware wallets.","source":"FBI Washington Field Office / Fox News","source_url":"https://x.com/FBIWFO/status/2029678454694642051"},{"date":"2026-03-05","event":"FBI Director Kash Patel publicly announces arrest via X and shares photos of Daghita in custody and the seized suitcase of cash and hardware wallets.","source":"FBI Washington Field Office on X","source_url":"https://x.com/FBIWFO/status/2029678454694642051"},{"date":"2026-03-26","event":"Federal grand jury in Alexandria, Virginia, returns a 15-count indictment against John Daghita in the Eastern District of Virginia, charging wire fraud, theft of public money, money laundering, and unlawful monetary transactions.","source":"Mike Levine on X / Decrypt","source_url":"https://x.com/MLevineReports/status/2037614378577433076?lang=en"},{"date":"2026-05-21","event":"Daghita appears before the indictment chamber of the Court of Appeal in Basse-Terre, Guadeloupe. He reportedly requests his own extradition to the United States, stating he wants to explain himself in U.S. courts. Magistrates reserve decision until May 28.","source":"Dark Web Informer on X / Phemex News","source_url":"https://phemex.com/news/article/french-court-reviews-extradition-of-american-accused-of-46m-crypto-theft-84748"},{"date":"2026-05-28","event":"Basse-Terre Court of Appeal approves extradition of John Daghita to the United States.","source":"CryptoAdventure","source_url":"https://cryptoadventure.com/john-lick-daghita-extradition-approved-in-46m-us-marshals-crypto-case/"}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 291aca65-5862-4afd-937a-97d5c8ef59a0copy