Verify a decision

{"actor":"system:backfill","investigation_id":"8fa340a0-746a-46cd-b014-5c0b7022446e","kind":"publish","page_slug":"john-daghita","published_at":"2026-05-25T18:25:36.003Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"John Daghita","sections":[{"content":"John Daghita was arrested on the evening of March 4, 2026, on the Caribbean island of Saint Martin by the French Gendarmerie's elite tactical unit (GIGN) in a joint operation with the FBI's Washington Field Office. FBI Director Kash Patel publicly announced the arrest via X (formerly Twitter), confirming that Daghita 'allegedly stole more than $46 million in cryptocurrency from the U.S. Marshals Service.' Physical evidence recovered at the scene included a metal briefcase containing US currency, multiple USB drives, hardware cryptocurrency wallets, and a passport. US authorities announced plans to pursue extradition proceedings. Daghita faces alleged charges including theft of government property, wire fraud, and money laundering. As of the announcement date, no formal federal indictment had been made publicly available.","heading":"Arrest and Criminal Charges","severity":"critical","sources":[{"credibility":1,"name":"Son of contractor managing seized crypto for U.S. Marshals arrested in France over alleged $46m theft — CoinDesk","type":"news_article","url":"https://www.coindesk.com/business/2026/03/05/son-of-u-s-government-contractor-accused-of-stealing-millions-in-seized-crypto-arrested-in-france"},{"credibility":1,"name":"FBI Nabs Contractor for Allegedly Stealing Crypto From Marshals — Bloomberg","type":"news_article","url":"https://www.bloomberg.com/news/articles/2026-03-05/fbi-arrests-contractor-in-alleged-crypto-theft-held-by-marshals"},{"credibility":1,"name":"US government contractor accused of stealing $46M arrested on small island, FBI announces — Fox News","type":"news_article","url":"https://www.foxnews.com/us/us-government-contractor-accused-stealing-46m-arrested-small-island-fbi-announces"},{"credibility":2,"name":"US contractor's son arrested over alleged $46M crypto theft — The Register","type":"news_article","url":"https://www.theregister.com/2026/03/06/contractor_son_crypto_arrest/"},{"credibility":2,"name":"FBI arrests crypto thief accused of stealing $46 million from seized government wallets — Tom's Hardware","type":"news_article","url":"https://www.tomshardware.com/tech-industry/cryptocurrency/fbi-arrests-crypto-thief-accused-of-stealing-usd46-million-from-seized-government-wallets-suspects-father-was-allegedly-contractor-for-the-us-marshals"},{"credibility":2,"name":"John Daghita aka John/Lick Arrested in Alleged Cryptocurrency Theft Tied to US Marshals Service — TRM Labs","type":"research","url":"https://www.trmlabs.com/resources/blog/john-daghita-aka-john-lick-arrested-in-alleged-cryptocurrency-theft-tied-to-us-marshals-service"}]},{"content":"Daghita is alleged to have exploited insider access to cryptocurrency wallets managed by the US Marshals Service (USMS) through his proximity to CMDSS, the private contractor operated by his father. The alleged theft is estimated at over $46 million, though initial reports from January 2026 cited approximately $40 million as the investigation was still ongoing. On-chain analysis by ZachXBT traced approximately $24.9 million transferred from a US government-controlled wallet in March 2024 to addresses attributed to Daghita; that government wallet held funds originally seized in connection with the 2016 Bitfinex hack. A separate anomalous drain of approximately $20 million from a government wallet occurred in October 2024; most funds were reportedly recovered within 24 hours, but roughly $700,000 moved through instant exchanges was not recovered, and the incident was not publicly disclosed at the time. ZachXBT identified a wallet holding approximately 12,540 ETH — worth approximately $36.3 million at the time of identification — allegedly controlled by Daghita. Total inflows across wallets attributed to Daghita were estimated at over $90 million across 2024 and 2025. The precise technical mechanism by which Daghita allegedly accessed and transferred the government-controlled assets has not been detailed in any publicly available charging document as of this report.","heading":"Alleged Theft from US Marshals Service","severity":"critical","sources":[{"credibility":1,"name":"U.S. Marshals investigate claims that son of government contractor stole $40 million of seized crypto — CoinDesk","type":"news_article","url":"https://www.coindesk.com/business/2026/01/26/u-s-marshals-investigate-claims-that-son-of-government-contractor-stole-usd40-million-of-seized-crypto"},{"credibility":2,"name":"John Daghita aka John/Lick Arrested in Alleged Cryptocurrency Theft Tied to US Marshals Service — TRM Labs","type":"research","url":"https://www.trmlabs.com/resources/blog/john-daghita-aka-john-lick-arrested-in-alleged-cryptocurrency-theft-tied-to-us-marshals-service"},{"credibility":2,"name":"ZachXBT Uncovers Crypto Theft Network Linked to US Government Seizure Funds — TRM Labs","type":"research","url":"https://www.trmlabs.com/resources/blog/zachxbt-uncovers-crypto-theft-network-linked-to-us-government-seizure-funds"},{"credibility":1,"name":"U.S. Marshals Service under scrutiny after insider allegedly stole $25 million from federal crypto wallets — Fortune","type":"news_article","url":"https://fortune.com/2026/02/06/us-marshals-service-scrutiny-insider-allegedly-stole-25-million-federal-crypto-wallets/"}]},{"content":"Command Services & Support (CMDSS) is a Virginia-based technology firm founded in 2011 and led by Dean Daghita, John's father, who serves as president and CEO. The firm advertises mission-critical IT and operational support services to the US Department of Defense and Department of Justice. In October 2024, CMDSS was awarded a contract by the USMS to manage and dispose of seized and forfeited cryptocurrency classified as Class 2–4 — coins not supported by mainstream centralized exchanges, including assets tied to complex criminal cases such as funds from the 2016 Bitfinex hack. The total value of CMDSS government contracts has been reported at approximately $7.8 million across 2024 to 2026, with the primary management contract valued at approximately $4 million. The contract was contested by a competitor, Wave Digital Assets, which filed a protest with the Government Accountability Office (GAO), alleging that CMDSS lacked proper SEC and FINRA licensing and that the hiring of a former USMS official created a conflict of interest. The GAO concluded the contract award was not improper. Following ZachXBT's public identification of John Daghita in January 2026, the CMDSS website was taken offline and its social media accounts were deactivated.","heading":"CMDSS and the Dean Daghita Connection","severity":"critical","sources":[{"credibility":1,"name":"Individual behind $40 million government wallet theft is son of seized-crypto contractor executive: ZachXBT — The Block","type":"news_article","url":"https://www.theblock.co/post/386945/individual-behind-40-million-government-wallet-theft-is-son-of-seized-crypto-contractor-executive-zachxbt"},{"credibility":2,"name":"US contractor's son arrested over alleged $46M crypto theft — The Register","type":"news_article","url":"https://www.theregister.com/2026/03/06/contractor_son_crypto_arrest/"},{"credibility":1,"name":"U.S. Marshals Service under scrutiny after insider allegedly stole $25 million from federal crypto wallets — Fortune","type":"news_article","url":"https://fortune.com/2026/02/06/us-marshals-service-scrutiny-insider-allegedly-stole-25-million-federal-crypto-wallets/"},{"credibility":2,"name":"US Government Investigating $40 Million Crypto Theft Linked To Federal Contractor's Son — Bitcoin Magazine","type":"news_article","url":"https://bitcoinmagazine.com/news/us-investigating-40-million-crypto-theft"}]},{"content":"On January 23, 2026, blockchain investigator ZachXBT publicly identified the individual behind the online aliases 'John' and 'Lick' as John Daghita. The identification originated from a recorded Telegram 'band-for-band' exchange — a social media ritual in which participants compete by displaying cryptocurrency holdings — in which a participant using the handle 'Lick' inadvertently revealed multiple wallet addresses during a dispute. The participant displayed an Exodus wallet holding approximately $2.3 million on the TRON network, then transferred approximately $6.7 million in Ethereum to another address in real time, with associated wallets totaling approximately $23 million across the exchange. ZachXBT traced the observable wallet addresses and identified that $24.9 million had flowed into one of those addresses from a US government seizure wallet in March 2024. ZachXBT described the attribution as based on 'observable address control and transaction hashes' made visible during the live exchange. ZachXBT linked the alias to John Daghita through publicly available information connecting the online persona to Dean Daghita's son. ZachXBT stated his findings were 'for now just allegations.' The USMS confirmed an active investigation shortly after ZachXBT's public disclosure. According to reporting, Daghita subsequently taunted ZachXBT on Telegram and allegedly sent small amounts of the disputed cryptocurrency to ZachXBT's public wallet address — a practice known as a dust attack — before disappearing from public channels.","heading":"ZachXBT Identification and Initial Exposure","severity":"high","sources":[{"credibility":1,"name":"U.S. Marshals investigate claims that son of government contractor stole $40 million of seized crypto — CoinDesk","type":"news_article","url":"https://www.coindesk.com/business/2026/01/26/u-s-marshals-investigate-claims-that-son-of-government-contractor-stole-usd40-million-of-seized-crypto"},{"credibility":2,"name":"ZachXBT Alleges Son of US Government Crypto Custodian CEO Behind Wallet Theft — Yahoo News","type":"news_article","url":"https://www.yahoo.com/news/articles/zachxbt-alleges-son-us-government-073859018.html"},{"credibility":2,"name":"John Daghita aka John/Lick Arrested — TRM Labs","type":"research","url":"https://www.trmlabs.com/resources/blog/john-daghita-aka-john-lick-arrested-in-alleged-cryptocurrency-theft-tied-to-us-marshals-service"},{"credibility":2,"name":"ZachXBT Uncovers Crypto Theft Network Linked to US Government Seizure Funds — TRM Labs","type":"research","url":"https://www.trmlabs.com/resources/blog/zachxbt-uncovers-crypto-theft-network-linked-to-us-government-seizure-funds"}]},{"content":"Shortly after ZachXBT's public identification of Daghita in late January 2026, an individual operating under the 'Lick' alias launched a Solana-based meme coin — ticker $LICK — on the Pump.fun token launchpad. Daghita allegedly controlled approximately 40% of the total $LICK token supply at launch, a level of concentration flagged by on-chain analytics firm Bubblemaps as a critical manipulation risk. Bubblemaps reported that the deployer wallet had accumulated token positions during at least four purchases while the market capitalization was still below $21,000, ahead of a sharp price rally — a pattern consistent with bundling strategies designed to front-run retail buyers. The token subsequently experienced a large speculative surge before collapsing more than 97% in value within its first 24 hours of trading, falling from a reported peak market capitalization of approximately $915,000 to approximately $27,700. Pump.fun removed the $LICK token from its platform mid-trading — one of the platform's rare documented instances of manual intervention. Bubblemaps confirmed on-chain that the LICK deployer wallet was directly connected to wallets identified in ZachXBT's investigation of the alleged government theft, linking the meme coin launch to the broader criminal allegations.","heading":"$LICK Token Launch, Manipulation, and Delisting","severity":"critical","sources":[{"credibility":2,"name":"Bubblemaps Flags LICK Token as On-Chain Data Ties Launch to Alleged $40M US Government Theft — CryptoPotato","type":"on_chain","url":"https://cryptopotato.com/bubblemaps-flags-lick-token-as-on-chain-data-ties-launch-to-alleged-40m-us-government-theft/"},{"credibility":2,"name":"Wallet Tied to US Crypto Theft Launches Solana Meme Coin — Plunges 97% Overnight — Yahoo Finance","type":"news_article","url":"https://finance.yahoo.com/news/wallet-tied-us-crypto-theft-121457871.html"},{"credibility":2,"name":"US Crypto Theft Wallet Launches Solana Meme Coin — Why PumpFun Deleted $LICK — Yahoo Finance","type":"news_article","url":"https://finance.yahoo.com/news/us-crypto-theft-wallet-launches-121457700.html"},{"credibility":2,"name":"Wallet Tied to Alleged US Crypto Theft Launches Memecoin — CoinTelegraph","type":"news_article","url":"https://cointelegraph.com/news/us-treasury-theft-wallet-bundled-memecoin-crashes-97"},{"credibility":2,"name":"Solana Meme Coin Tied to Alleged U.S. Crypto Theft Deleted — CryptoNews","type":"news_article","url":"https://cryptonews.com/news/us-crypto-theft-wallet-solana-memecoin-lick-pumpfun/"}]},{"content":"Blockchain analytics conducted by TRM Labs and ZachXBT produced the following on-chain findings, which have not been formally disputed but also have not been independently verified in court proceedings: a wallet attributed to Daghita received approximately $24.9 million from a US government-controlled seizure address in March 2024; the same wallet cluster received substantial inflows during Q4 2025; a single wallet allegedly controlled by Daghita held approximately 12,540 ETH worth approximately $36.3 million at time of identification; and total inflows across attributed wallets were estimated at over $90 million across 2024 and 2025. Following ZachXBT's January 23, 2026 disclosure, funds associated with those wallets were moved through mixers and across multiple blockchains in an apparent obfuscation effort. The $LICK deployer wallet on Solana was separately confirmed by Bubblemaps to be linked on-chain to the Ethereum wallets involved in the alleged theft. TRM Labs described the Telegram-based attribution method as yielding 'high-confidence' identification due to the live, observable on-chain transaction execution during the band-for-band exchange.","heading":"On-Chain Wallet Tracing and Analytics","severity":"critical","sources":[{"credibility":2,"name":"John Daghita aka John/Lick Arrested in Alleged Cryptocurrency Theft Tied to US Marshals Service — TRM Labs","type":"on_chain","url":"https://www.trmlabs.com/resources/blog/john-daghita-aka-john-lick-arrested-in-alleged-cryptocurrency-theft-tied-to-us-marshals-service"},{"credibility":2,"name":"ZachXBT Uncovers Crypto Theft Network Linked to US Government Seizure Funds — TRM Labs","type":"on_chain","url":"https://www.trmlabs.com/resources/blog/zachxbt-uncovers-crypto-theft-network-linked-to-us-government-seizure-funds"},{"credibility":2,"name":"Bubblemaps Flags LICK Token as On-Chain Data Ties Launch to Alleged $40M US Government Theft — CryptoPotato","type":"on_chain","url":"https://cryptopotato.com/bubblemaps-flags-lick-token-as-on-chain-data-ties-launch-to-alleged-40m-us-government-theft/"},{"credibility":1,"name":"U.S. Marshals investigate claims that son of government contractor stole $40 million of seized crypto — CoinDesk","type":"news_article","url":"https://www.coindesk.com/business/2026/01/26/u-s-marshals-investigate-claims-that-son-of-government-contractor-stole-usd40-million-of-seized-crypto"}]},{"content":"The Daghita case drew scrutiny to the USMS's practices for managing and safeguarding seized cryptocurrency assets through private third-party contractors. The alleged breach ran undetected from at least October 2024 through January 2026 — more than a year — despite an anomalous drain in October 2024 that was reportedly not publicly disclosed. Critics noted that awarding custody of substantial government crypto holdings to a small private contractor with limited public track record creates systemic risk when inadequate multi-signature controls or real-time wallet monitoring are in place. A February 2026 Fortune investigation highlighted broader concerns about insider access at the USMS. Reporting elsewhere cited concern that over 300,000 BTC in US government holdings could face similar risks given structural reliance on private contractors with limited oversight. The GAO had previously cleared the CMDSS contract award despite the Wave Digital Assets protest citing licensing deficiencies. The case has prompted discussion among policy observers regarding minimum standards for private firms entrusted with federal digital asset custody.","heading":"Broader Implications for US Government Crypto Custody","severity":"high","sources":[{"credibility":1,"name":"U.S. Marshals Service under scrutiny after insider allegedly stole $25 million from federal crypto wallets — Fortune","type":"news_article","url":"https://fortune.com/2026/02/06/us-marshals-service-scrutiny-insider-allegedly-stole-25-million-federal-crypto-wallets/"},{"credibility":2,"name":"Over 300K US Government Bitcoin at Risk After Alleged Insider Theft Exposes Custody Failures — Yahoo Finance","type":"news_article","url":"https://finance.yahoo.com/news/over-300k-us-government-bitcoin-104830820.html"},{"credibility":2,"name":"US Government Investigating $40 Million Crypto Theft Linked To Federal Contractor's Son — Bitcoin Magazine","type":"news_article","url":"https://bitcoinmagazine.com/news/us-investigating-40-million-crypto-theft"},{"credibility":2,"name":"John Daghita Arrested In Alleged Crypto Heist Tied To US Marshals Service: Analysis — Crowdfund Insider","type":"news_article","url":"https://www.crowdfundinsider.com/2026/03/265623-john-daghita-arrested-in-alleged-crypto-heist-tied-to-us-marshals-service-analysis/"}]},{"content":"John Daghita has not been convicted of any crime as of the date of this report. He was arrested on March 4, 2026, and is awaiting extradition proceedings to the United States. All allegations described in this investigation reflect claims made by law enforcement agencies, federal investigators, and on-chain researchers, and have not been tested or adjudicated in court. Daghita is presumed innocent under US law.","heading":"Presumption of Innocence","severity":"low","sources":[{"credibility":1,"name":"Son of contractor managing seized crypto for U.S. Marshals arrested in France over alleged $46m theft — CoinDesk","type":"news_article","url":"https://www.coindesk.com/business/2026/03/05/son-of-u-s-government-contractor-accused-of-stealing-millions-in-seized-crypto-arrested-in-france"}]}],"sources_used":[{"credibility":1,"name":"Son of contractor managing seized crypto for U.S. Marshals arrested in France over alleged $46m theft — CoinDesk","type":"news_article","url":"https://www.coindesk.com/business/2026/03/05/son-of-u-s-government-contractor-accused-of-stealing-millions-in-seized-crypto-arrested-in-france"},{"credibility":1,"name":"U.S. Marshals investigate claims that son of government contractor stole $40 million of seized crypto — CoinDesk","type":"news_article","url":"https://www.coindesk.com/business/2026/01/26/u-s-marshals-investigate-claims-that-son-of-government-contractor-stole-usd40-million-of-seized-crypto"},{"credibility":1,"name":"FBI Nabs Contractor for Allegedly Stealing Crypto From Marshals — Bloomberg","type":"news_article","url":"https://www.bloomberg.com/news/articles/2026-03-05/fbi-arrests-contractor-in-alleged-crypto-theft-held-by-marshals"},{"credibility":1,"name":"US government contractor accused of stealing $46M arrested on small island, FBI announces — Fox News","type":"news_article","url":"https://www.foxnews.com/us/us-government-contractor-accused-stealing-46m-arrested-small-island-fbi-announces"},{"credibility":1,"name":"U.S. Marshals Service under scrutiny after insider allegedly stole $25 million from federal crypto wallets — Fortune","type":"news_article","url":"https://fortune.com/2026/02/06/us-marshals-service-scrutiny-insider-allegedly-stole-25-million-federal-crypto-wallets/"},{"credibility":1,"name":"Individual behind $40 million government wallet theft is son of seized-crypto contractor executive — The Block","type":"news_article","url":"https://www.theblock.co/post/386945/individual-behind-40-million-government-wallet-theft-is-son-of-seized-crypto-contractor-executive-zachxbt"},{"credibility":2,"name":"US contractor's son arrested over alleged $46M crypto theft — The Register","type":"news_article","url":"https://www.theregister.com/2026/03/06/contractor_son_crypto_arrest/"},{"credibility":2,"name":"FBI arrests crypto thief accused of stealing $46 million from seized government wallets — Tom's Hardware","type":"news_article","url":"https://www.tomshardware.com/tech-industry/cryptocurrency/fbi-arrests-crypto-thief-accused-of-stealing-usd46-million-from-seized-government-wallets-suspects-father-was-allegedly-contractor-for-the-us-marshals"},{"credibility":2,"name":"John Daghita aka John/Lick Arrested in Alleged Cryptocurrency Theft Tied to US Marshals Service — TRM Labs","type":"research","url":"https://www.trmlabs.com/resources/blog/john-daghita-aka-john-lick-arrested-in-alleged-cryptocurrency-theft-tied-to-us-marshals-service"},{"credibility":2,"name":"ZachXBT Uncovers Crypto Theft Network Linked to US Government Seizure Funds — TRM Labs","type":"research","url":"https://www.trmlabs.com/resources/blog/zachxbt-uncovers-crypto-theft-network-linked-to-us-government-seizure-funds"},{"credibility":2,"name":"Bubblemaps Flags LICK Token as On-Chain Data Ties Launch to Alleged $40M US Government Theft — CryptoPotato","type":"on_chain","url":"https://cryptopotato.com/bubblemaps-flags-lick-token-as-on-chain-data-ties-launch-to-alleged-40m-us-government-theft/"},{"credibility":2,"name":"Wallet Tied to US Crypto Theft Launches Solana Meme Coin — Plunges 97% Overnight — Yahoo Finance","type":"news_article","url":"https://finance.yahoo.com/news/wallet-tied-us-crypto-theft-121457871.html"},{"credibility":2,"name":"US Crypto Theft Wallet Launches Solana Meme Coin — Why PumpFun Deleted $LICK — Yahoo Finance","type":"news_article","url":"https://finance.yahoo.com/news/us-crypto-theft-wallet-launches-121457700.html"},{"credibility":2,"name":"Wallet Tied to Alleged US Crypto Theft Launches Memecoin — CoinTelegraph","type":"news_article","url":"https://cointelegraph.com/news/us-treasury-theft-wallet-bundled-memecoin-crashes-97"},{"credibility":2,"name":"Solana Meme Coin Tied to Alleged U.S. Crypto Theft Deleted — CryptoNews","type":"news_article","url":"https://cryptonews.com/news/us-crypto-theft-wallet-solana-memecoin-lick-pumpfun/"},{"credibility":2,"name":"US Government Investigating $40 Million Crypto Theft Linked To Federal Contractor's Son — Bitcoin Magazine","type":"news_article","url":"https://bitcoinmagazine.com/news/us-investigating-40-million-crypto-theft"},{"credibility":2,"name":"U.S. Contractor Arrested In $46M Theft Of Government Crypto — Bitcoin Magazine","type":"news_article","url":"https://bitcoinmagazine.com/news/u-s-crypto-contractor-arrested-theft"},{"credibility":2,"name":"Over 300K US Government Bitcoin at Risk After Alleged Insider Theft Exposes Custody Failures — Yahoo Finance","type":"news_article","url":"https://finance.yahoo.com/news/over-300k-us-government-bitcoin-104830820.html"},{"credibility":2,"name":"ZachXBT Alleges Son of US Government Crypto Custodian CEO Behind Wallet Theft — Yahoo News","type":"news_article","url":"https://www.yahoo.com/news/articles/zachxbt-alleges-son-us-government-073859018.html"},{"credibility":2,"name":"FBI picks up John Lick Daghita, contractor accused of $46M BTC theft — Cryptopolitan","type":"news_article","url":"https://www.cryptopolitan.com/fbi-picks-john-daghita-contractor-btc-theft/"},{"credibility":2,"name":"John Daghita Arrested In Alleged Crypto Heist Tied To US Marshals Service: Analysis — Crowdfund Insider","type":"news_article","url":"https://www.crowdfundinsider.com/2026/03/265623-john-daghita-arrested-in-alleged-crypto-heist-tied-to-us-marshals-service-analysis/"},{"credibility":2,"name":"Who is John Daghita? Inside the US government's $40M crypto theft claim — Crypto.news","type":"news_article","url":"https://crypto.news/who-is-john-daghita-inside-the-us-governments-40m-crypto-theft-case/"},{"credibility":2,"name":"Inside the $46 Million Theft From U.S. Government Crypto Wallets — ETHNews","type":"news_article","url":"https://www.ethnews.com/inside-the-46-million-theft-from-u-s-government-crypto-wallets-and-the-telegram-post-that-ended-it/"}],"summary":"John Daghita, age 25, known online as 'Lick,' is a US national arrested on March 4, 2026, on the Caribbean island of Saint Martin in a joint FBI and French Gendarmerie operation. He is alleged to have stolen more than $46 million in cryptocurrency from wallets managed by the US Marshals Service through insider access tied to CMDSS, a Virginia-based private contractor operated by his father, Dean Daghita. Following his public identification by blockchain investigator ZachXBT in January 2026, Daghita launched the $LICK meme coin on Pump.fun while allegedly controlling approximately 40% of total supply; the token surged before crashing 97%, and Pump.fun delisted it mid-trading.","timeline":[{"date":"2024-03-01","event":"Approximately $24.9 million allegedly transferred from a US government-controlled wallet (holding Bitfinex-seized assets) to addresses later attributed to Daghita by ZachXBT.","source":"TRM Labs / CoinDesk","source_url":"https://www.trmlabs.com/resources/blog/zachxbt-uncovers-crypto-theft-network-linked-to-us-government-seizure-funds"},{"date":"2024-10-01","event":"CMDSS awarded a contract by the US Marshals Service to manage and dispose of seized Class 2–4 digital assets, reportedly valued at approximately $4 million.","source":"The Register","source_url":"https://www.theregister.com/2026/03/06/contractor_son_crypto_arrest/"},{"date":"2024-10-15","event":"Approximately $20 million allegedly drained from a US government seizure wallet in a separate incident; most funds reportedly recovered within 24 hours, but roughly $700,000 routed through instant exchanges was not recovered. The incident was not publicly disclosed at the time.","source":"TRM Labs","source_url":"https://www.trmlabs.com/resources/blog/zachxbt-uncovers-crypto-theft-network-linked-to-us-government-seizure-funds"},{"date":"2026-01-23","event":"ZachXBT observes and records a Telegram band-for-band exchange in which a user known as 'Lick' screen-shares a live wallet and broadcasts fund transfers, inadvertently providing real-time on-chain attribution. ZachXBT publicly identifies the individual as John Daghita, son of CMDSS president Dean Daghita. The US Marshals Service opens an investigation.","source":"CoinDesk","source_url":"https://www.coindesk.com/business/2026/01/26/u-s-marshals-investigate-claims-that-son-of-government-contractor-stole-usd40-million-of-seized-crypto"},{"date":"2026-01-23","event":"Following public exposure, funds in wallets attributed to Daghita begin moving through mixers and cross-chain bridges in an apparent obfuscation effort.","source":"TRM Labs","source_url":"https://www.trmlabs.com/resources/blog/john-daghita-aka-john-lick-arrested-in-alleged-cryptocurrency-theft-tied-to-us-marshals-service"},{"date":"2026-01-24","event":"$LICK meme coin launched on Pump.fun on the Solana blockchain by an address subsequently linked on-chain by Bubblemaps to the alleged government theft wallets. Deployer holds approximately 40% of total supply.","source":"CryptoPotato / CoinTelegraph","source_url":"https://cryptopotato.com/bubblemaps-flags-lick-token-as-on-chain-data-ties-launch-to-alleged-40m-us-government-theft/"},{"date":"2026-01-25","event":"$LICK token peaks at approximately $915,000 market capitalization before collapsing more than 97% within 24 hours. Pump.fun delists the token mid-trading.","source":"Yahoo Finance / CryptoPotato","source_url":"https://finance.yahoo.com/news/wallet-tied-us-crypto-theft-121457871.html"},{"date":"2026-01-26","event":"CMDSS website taken offline; company social media accounts deactivated.","source":"The Register","source_url":"https://www.theregister.com/2026/03/06/contractor_son_crypto_arrest/"},{"date":"2026-02-06","event":"Fortune publishes an investigation into US Marshals Service crypto custody practices and broader systemic risks exposed by the alleged insider theft.","source":"Fortune","source_url":"https://fortune.com/2026/02/06/us-marshals-service-scrutiny-insider-allegedly-stole-25-million-federal-crypto-wallets/"},{"date":"2026-03-04","event":"John Daghita arrested on the island of Saint Martin in a joint FBI and French Gendarmerie operation. A briefcase containing cash, hardware wallets, USB drives, and a passport are seized at the scene.","source":"Fox News / CoinDesk / Bloomberg","source_url":"https://www.foxnews.com/us/us-government-contractor-accused-stealing-46m-arrested-small-island-fbi-announces"},{"date":"2026-03-05","event":"FBI Director Kash Patel publicly announces the arrest, confirming the allegation of more than $46 million stolen from the US Marshals Service and stating that extradition proceedings will be pursued.","source":"Bloomberg / Fox News","source_url":"https://www.bloomberg.com/news/articles/2026-03-05/fbi-arrests-contractor-in-alleged-crypto-theft-held-by-marshals"}]},"v":1}