The US Marshals Service (USMS) is investigating allegations that the son of a Department of Defense and Department of Justice service provider, accused of managing cryptocurrencies seized by law enforcement, stole more than $40 million in seized digital assets.
Blockchain researcher ZachXBT accused John “Lick” Daghita, son of Dean Daghita, president of CMDSS (a firm that says on its website that it provides critical services for the Department of Justice and the Department of Defense) of stealing digital assets seized from cryptowalltes managed by his father’s company.
ZachXBT, who said he reported John to authorities, said it is still unclear how John Daghita allegedly gained access to the wallets, or even whether that access occurred through his father.
Brady McCarron, head of public affairs for the USMS, told CoinDesk that the agency could not comment further on this case because investigations were ongoing.
“Meet threat actor John (Lick), who was caught flashing $23 million in a wallet address directly linked to more than $90 million in alleged theft from the US government in 2024 and numerous other unidentified victims from November 2025 to December 2025,” ZachXBT posted on X last Friday.
ZachXBT identified the individual as John Daghita, alleging that CMDSS currently has an active federal IT contract. The blockchain researcher later said he reported a wallet address containing 12,540 ETH, worth approximately $36.3 million, which he said was controlled by Daghita. ZachXBT added that Daghita sent him 0.6767 ETH, which he said he would forward to a US government seizure address.
“In case you are curious about how John Daghita (Lick) was able to steal over $40 million from US government seizure addresses: John’s father owns CMDSS, which currently has an active government IT contract in Virginia,” wrote ZachXBT, pointing to a CoinDesk report that CMDSS was awarded a contract to assist the US Marshals Service (USMS) in managing and removing seized and confiscated crypto assets.
The Department of Defense, ZachXBT and CMDSS did not immediately respond to a request for comment from CoinDesk.
Captured on video
In February 2025, after the White House announced it was considering a national cryptocurrency reserve, a source familiar with the matter told CoinDesk that the US Marshals Service did not appear to know how much cryptocurrency it held.
The USMS is tasked with managing assets seized by authorities during criminal investigations, including real estate, cash, jewelry, antiques and vehicles.
John Daghita came to attention after becoming involved in a recorded discussion in a Telegram group chat with another individual. The exchange, known in cybercriminal circles as “gang-for-gang,” involved both participants trying to prove who controlled more cryptocurrency. ZachXBT captured the dispute on video.
“In part 1 of the (video) During filming, Dritan (another menacing actor) makes fun of John,” Zach said. “However, John shares the screen [a] Exodus Wallet”, showing $2.3 million. In part 2 of the recording, Dritan continued to mock John as another $6.7 million worth of ETH” is moved to a wallet address.
ZachXBT said the full recording shows Daghita “clearly controls both directions.” The detective then explained that he traced the funds to verify their origin and discovered that at least $23 million was linked to approximately $90 million in cryptocurrency seized by the government in 2024 and 2025.
“Threat actors only continue to show stolen funds in leaked recordings instead of simply staying silent after an alleged theft from the US government,” Zach criticized, saying they only make it easier for law enforcement to support a case against them.
