The U.S. Marshals Service (USMS) is investigating allegations that John "Lick" Daghita, son of the president of CMDSS — a firm providing IT services to the Department of Justice and Department of Defense — stole more than $40 million worth of seized digital assets from wallets managed by his father's company.
Blockchain investigator ZachXBT publicly identified Daghita in a series of posts on X, stating that CMDSS holds an active federal IT contract. He alleged that Daghita gained access to government seizure wallets, though it remains unclear whether that access came through his father.
“Meet the threat actor John (Lick), who was caught flexing $23M in a wallet address directly tied to $90M+ in suspected thefts from the US Government in 2024 and multiple other unidentified victims from Nov 2025 to Dec 2025,” ZachXBT posted. He later reported a wallet address holding 12,540 ETH (approximately $36.3 million) to authorities, which he said was controlled by Daghita.
Leaked Telegram Recording Reveals Wallet Control
Daghita drew attention after a recorded argument in a Telegram group chat with another threat actor known as Dritan. The exchange, a "band for band" in cybercriminal circles, involved both participants trying to prove who controlled more crypto. ZachXBT captured the dispute on video.
“In part 1 of the recording, Dritan mocks John,” Zach said. “However, John screenshares an Exodus Wallet,” showing $2.3 million. In part 2, another $6.7 million worth of ETH was moved into a wallet address. ZachXBT said the full recording shows Daghita “clearly controls both addresses.” On-chain tracing then revealed that at least $23 million of those funds was tied to roughly $90 million in crypto seized by the government in 2024 and 2025.
ZachXBT also noted that Daghita sent him 0.6767 ETH, which he said he would forward to a U.S. government seizure address.
Father's Company Holds DoD/DoJ Contracts
“In case you are curious how John Daghita (Lick) was able to steal $40 million plus from U.S. government seizure addresses: John’s dad owns CMDSS, which currently has an active IT government contract in Virginia,” ZachXBT wrote, citing a CoinDesk report that CMDSS was awarded a contract to assist the USMS in managing and disposing of seized and forfeited crypto assets.
Brady McCarron, chief of public affairs for the USMS, told CoinDesk the agency could not comment further due to the ongoing investigation. The Department of Defense, ZachXBT, and CMDSS did not immediately respond to requests for comment.
In February 2025, after the White House announced it was considering a national crypto reserve, a source familiar with the matter told CoinDesk that the USMS did not appear to know how much cryptocurrency it held. The agency manages assets seized during criminal investigations, including real estate, cash, jewelry, antiques, and vehicles.
“Threat actors only continue showing off stolen funds in leaked recordings rather than simply staying quiet after an alleged theft from the U.S. government,” ZachXBT criticized, saying they make it easy for law enforcement to build a case against them.