John Daghita
Summary
John Daghita, a 22-year-old operating online under the alias 'Lick', is alleged to have stolen approximately $46 million in cryptocurrency from wallets controlled by the U.S. Marshals Service (USMS) by leveraging privileged access derived from his father's federal contracting firm, Command Services & Support (CMDSS). Daghita was arrested on Saint Martin in March 2026 following a joint FBI and French Gendarmerie operation triggered in part by blockchain investigator ZachXBT's public exposure of his wallet activity during a Telegram 'band-for-band' exchange. As of May 2026, a French appellate court approved extradition and Daghita consented to transfer to the United States to face federal charges.
Connected Entities
1 entities · 10 linked investigations- + 1 more
Timeline(12 events)
2024-10
CMDSS, a Virginia-based firm run by Dean Daghita (John Daghita's father), awarded a $4 million contract by the U.S. Marshals Service to assist with custody and disposition of seized cryptocurrency, including Bitfinex hack recovery funds.
CoinDesk / Fortune2024-03
Approximately $24.9 million in government-seized cryptocurrency (linked to the 2016 Bitfinex hack recovery) was allegedly transferred from a U.S. government-controlled wallet (0xc7a2) as part of the alleged theft.
CoinDesk / ZachXBT via TRM Labs2025-12
An alleged initial unauthorized transfer of approximately $5 million from government-controlled wallets, per the DOJ indictment as reported.
Anderson Insights / Cryptopolitan2026-01
Approximately $41 million in additional alleged unauthorized transfers from USMS wallets, per the DOJ indictment as reported.
Anderson Insights / Cryptopolitan2026-01-23
John Daghita, operating as 'Lick', participates in a private Telegram 'band-for-band' exchange, screen-sharing wallet balances and conducting live transfers totaling approximately $23 million. ZachXBT observes the exchange and begins tracing the funds on-chain.
CoinDesk2026-01-26
U.S. Marshals Service confirms it is investigating allegations that more than $40 million in confiscated digital assets were siphoned from government-linked wallets. ZachXBT publicly names John Daghita as the alleged perpetrator and identifies his connection to CMDSS.
CoinDesk2026-02-06
Fortune reports on USMS oversight failures and the agency's lack of clarity about CMDSS's continued contractor status. CMDSS website goes private.
Fortune2026-03-04
John Daghita arrested on the island of Saint Martin in a joint operation by the French Gendarmerie's elite tactical unit and the FBI. Authorities recover a metal briefcase with $100 bills, multiple hardware wallets, and USB drives.
FBI Washington Field Office / CoinDesk2026-03-05
FBI Director Kash Patel publicly announces the arrest on X, releasing images of Daghita in custody and the seized materials.
FBI Washington Field Office (X)2026-03-05
DOJ files indictment against John Dean Daghita in the Eastern District of Virginia on charges including wire fraud, theft of government property, money laundering, and unlawful monetary transactions.
Cryptopolitan / Anderson Insights2026-05-21
At his first French court hearing, Daghita consents to extradition, stating he wishes to face the case in U.S. courts.
CryptoAdventure / Phemex News2026-05-30
The Basse-Terre Court of Appeal in Guadeloupe approves the U.S. extradition request. Daghita remains in custody pending transfer.
CryptoAdventure / Phemex NewsDecision Log
- hash: 5yKG5UESmoxMhdmQhZT8TQgS3YJ71guJFHdMu3iATnEQ
This investigation is cryptographically anchored to the Solana blockchain and source URLs are archived via the Internet Archive.
model: claude-sonnet-4-6
generated: 5/25/2026, 6:25:34 PM
last updated: 6/29/2026, 11:09:06 PM
avoid.net — verified advice for a post-truth world