← John Daghita (aka Lick) — US Marshals Crypto Theftreviewed 2026-10-16 · 14 claims checked
Fact-check findings
What an automated fact-checker found when it re-read John Daghita (aka Lick) — US Marshals Crypto Theft against the sources the page cites. Only the most recent review is shown.
Read this first
These findings are produced by an automated reviewer, and its results vary between runs: the same page, checked three times on the same day, came back with 15%, 20% and 34% of its claims disputed, mostly because each run extracted a different number of claims. Treat what follows as leads, not rulings.
“Disputed” means the reviewer could not reconcile the claim with the evidence it cited. It does not mean the claim is false. “Unverifiable” means no reachable source settled it either way.
Nothing here changes the page on its own. A proposed correction is applied only after a human moderator approves it; until then the page reads as it did when reviewed.
unverifiable
4 claimsNo source the reviewer could reach confirms or contradicts the claim.
- #2[unverifiable][awaiting moderator]in the summary
“subsequently indicted on 15 federal counts including wire fraud, theft of government property, and money laundering”
reviewerDaghita was indicted on 15 federal counts including wire fraud, theft of government property, and money launderingThe sole source for the specific count (15) and charge list is a single journalist's X post, which could not be independently verified; no DOJ/USAO-EDVA press release or PACER docket turned up in search. The general fact that charges were filed is well corroborated, but the exact count and statute list is not. - #4[unverifiable][awaiting moderator]in section: Background: CMDSS Government Contract and the Alleged Family Link
“John Daghita was hired by the CMDSS-affiliated firm as a 'Cryptocurrency Subject Matter Expert,' giving him direct operational access to the government-linked custodial wallets”
reviewerJohn Daghita was hired as a 'Cryptocurrency Subject Matter Expert' with direct operational access to custodial wallets, per the March 26, 2026 indictmentNo independently fetched source names the specific job title 'Cryptocurrency Subject Matter Expert.' The broader claim that Daghita had operational access via his father's firm is well supported, but this exact title/indictment citation could not be corroborated. - #6[unverifiable][awaiting moderator]in section: The Alleged Theft: Amounts and Timeline
“On December 15, 2025, Daghita allegedly initiated three transfers totaling approximately $5 million from USMS-controlled wallets to addresses he personally controlled.”
reviewerDec 15, 2025 three transfers totaling ~$5 million; Jan 22-23, 2026 wave of ~$41 million; USMS instructed return of $2M on Jan 22 and Daghita diverted it ~20 minutes laterThese granular transfer details (three Dec 15 transfers, the $41M Jan 22-23 wave, and the 20-minute diversion of $2M) trace to a single journalist's X post that returned HTTP 402 and could not be fetched. No secondary reporting independently corroborates these specific figures, though they are plausible and not contradicted by anything found. - #10[unverifiable][awaiting moderator]in section: Arrest in Saint Martin
“The operation was conducted in collaboration with the FBI Washington Field Office, with support from the FBI Cleveland Field Office. FBI Director Kash Patel publicly announced the arrest via a post on X (formerly Twitter) and shared images including Daghita in handcuffs and a metal suitcase reportedly containing $239,348 in cash, a Rolex GMT Master watch, and multiple hardware wallets alleged to contain stolen U.S. government cryptocurrency.”
reviewerArrest at Villa Sun Reset in Saint Martin; seized items include $239,348 in cash, a Rolex GMT Master, and hardware wallets; FBI Washington Field Office with FBI Cleveland Field Office supportThe core arrest event, location (Saint Martin), and general description (cash + devices seized) are well corroborated across many outlets, but the precise cash figure ($239,348), the Rolex GMT Master watch, the 'Villa Sun Reset' location name, and the specific FBI Washington/Cleveland field office attribution could not be found in any independently accessible source; the only cited source for these details is an X post that could not be fetched.
partially supported
4 claimsThe cited evidence supports part of the claim but not all of it.
- #3[partially supported][awaiting moderator]in section: Background: CMDSS Government Contract and the Alleged Family Link
“In October 2024, CMDSS was awarded a contract valued at approximately $4 million by the U.S. Marshals Service to assist with the custody and disposal of so-called 'Class 2-4' seized digital assets”
reviewerCMDSS was awarded a contract valued at approximately $4 million by the U.S. Marshals ServiceThe cited CoinDesk article does not state a contract figure at all. An independent source (Washington Monthly) puts CMDSS's total USMS contract exposure at $7.8 million across two awards, which is not clearly reconcilable with the page's single ~$4 million figure. The October 2024 date is plausible but the dollar amount is not well-supported by the citation given. - #9[partially supported][awaiting moderator]in section: The $LICK Memecoin
“The token was promoted via Telegram livestreams. It lost approximately 97% of its value within its first day of trading. Pump.fun subsequently delisted the $LICK ticker.”
reviewer$LICK token lost approximately 97% of its value within its first day of trading, was promoted via Telegram livestreams, and Pump.fun subsequently delisted the tickerThe 97%-in-one-day figure, the Telegram livestream promotion, and the delisting are all true per other reporting (Cointelegraph for the price drop, a Bubblemaps blog post for the Telegram promotion), but neither source actually cited on the page supports these specific details -- the cited Yahoo Finance piece in fact reports a different, lower price-drop figure and attributes 96% to an unrelated token. This is a sourcing mismatch rather than a factual error, but the citations should be corrected/supplemented. - #12[partially supported][awaiting moderator]in section: Extradition Proceedings
“On May 21, 2026, Daghita appeared before the indictment chamber of the Court of Appeal in Basse-Terre; the magistrates reserved their decision until May 28.”
reviewerDaghita appeared before the indictment chamber of the Court of Appeal in Basse-Terre on May 21, 2026; magistrates reserved decision until May 28; Daghita reportedly requested his own extraditionTwo independent sources (CryptoAdventure, and an AFP wire report via Ground News) support 'Basse-Terre' as the correct court, so the page's claim is more likely correct than not. However, one of the page's own three cited sources (Phemex) names a different court entirely (Bastia, in Corsica) and a different detention location -- an internal contradiction among the page's own citations that readers are not alerted to. The specific May 21 hearing date and the claim that Daghita personally requested extradition could not be independently corroborated beyond the page's own sources (including an unfetchable X post). - #14[partially supported][awaiting moderator]in section: Government Oversight and Systemic Failures
“The U.S. Marshals Service cryptocurrency custody procurement process reportedly underwent four restarts before the CMDSS contract was awarded in October 2024. Inspector General warnings about vulnerabilities in the custody chain were allegedly ignored.”
reviewerUSMS crypto custody procurement process underwent four restarts before the CMDSS contract was awarded; IG warnings were ignored; CMDSS held exclusive access to wallets holding billionsThe general claim of documented USMS crypto-custody oversight failures and OIG criticism is independently corroborated (Washington Monthly, citing a 2022 DOJ OIG audit, and reporting on a GAO bid protest by a competing contractor, Wave Digital Assets, that also sought a DOJ OIG probe). The specific 'four restarts' figure and the characterization that warnings were 'ignored' could not be verified because the cited Forbes article itself was blocked (403) and no other source stated a restart count.
confirmed
6 claimsThe cited evidence supports the claim as written.
- #1[confirmed][no action needed]in the summary
“He is alleged to have stolen more than $46 million in cryptocurrency from U.S. Marshals Service seizure wallets between December 2025 and January 2026”
reviewerDaghita stole more than $46 million in cryptocurrency from USMS seizure walletsThe $46 million total and USMS seizure-wallet link are corroborated across many independent outlets. The precise Dec 2025-Jan 2026 window could not be independently itemized but is consistent with the on-chain-dated transfers found in CoinDesk's reporting. - #5[confirmed][no action needed]in section: The Alleged Theft: Amounts and Timeline
“On-chain analysis by ZachXBT traced wallet address 0xc7a2, which allegedly received $24.9 million in March 2024 from a U.S. government address tied to the 2016 Bitfinex hack seizure.”
reviewerOn-chain analysis: wallet 0xc7a2 received $24.9 million in March 2024 from a government address tied to the 2016 Bitfinex hack seizure; over $90 million in total suspicious inflows linked to the 'John/Lick' personaDirectly confirmed by the cited CoinDesk article, which matches the page's figures closely. - #7[confirmed][no action needed]in section: Discovery: ZachXBT's Investigation and the Telegram Incident
“the participant operating under the 'John' or 'Lick' handle displayed an Exodus wallet showing a TRON address holding approximately $2.3 million, then transferred an additional $6.7 million in Ether live into an Ethereum address, and consolidated roughly $23 million into a single wallet (identified as 0xd8bc) over the course of the dispute”
reviewerBand-for-band exchange: TRON balance ~$2.3M, live transfer of $6.7M ETH, consolidation of ~$23M into wallet 0xd8bcDirectly and precisely confirmed by the cited CoinDesk article. - #8[confirmed][no action needed]in section: The $LICK Memecoin
“On-chain analysis by Bubblemaps showed that the deployer wallet retained approximately 40% of the total token supply.”
reviewerBubblemaps analysis: $LICK deployer wallet retained ~40% of total token supplyConfirmed by the cited source. - #11[confirmed][no action needed]in the summary
“John Daghita, a 21-year-old Virginia resident known online as 'John' or 'Lick,'”
reviewerDaghita's age is 21Multiple outlets close to the arrest date (Yahoo/Dallas Express) report 21, matching the page. A handful of later or lower-quality sources give 20, 22, or 25 -- likely drift/error in secondary coverage rather than evidence the page is wrong. - #13[confirmed][no action needed]in section: Extradition Proceedings
“The Basse-Terre Court of Appeal subsequently approved the extradition request, validating the transfer of Daghita to U.S. federal custody.”
reviewerBasse-Terre Court of Appeal subsequently approved the extradition requestThis specific claim, on its own, is well corroborated by an independent AFP-sourced report in addition to the cited CryptoAdventure article.
How this fits together. The reviewer reads the published page and its cited sources and records one finding per claim. A human moderator decides whether each proposed correction is applied; those decisions, and the score changes they cause, appear in the audit log. Earlier review runs are not shown here; only the latest reflects the page as it stands.