The U.S. government’s custody of seized digital assets is facing a catastrophic breach of trust. On-chain investigator ZachXBT has identified John “Lick” Daghita as the primary suspect in the theft of over $40 million from government-controlled wallets. Daghita is the son of Dean Daghita, CEO of Command Services & Support (CMDSS), the federal contractor hired by the U.S. Marshals Service (USMS) to safeguard those very assets.
The $90M Receipt
The exposure stems from a classic case of hubris. During a heated “band for band” argument in a Telegram chat, Daghita screen-shared his Exodus wallet to prove his wealth to a rival. The stream revealed a wallet holding $23 million and executed a live transfer of 12,540 ETH ($36.3 million).
ZachXBT correlated these on-chain movements with specific government seizures. The most damning transaction involved $24.9 million moved in March 2024, funds originally seized in connection with the 2016 Bitfinex hack. In total, Daghita’s wallet was linked to over $90 million in illicit inflows, with roughly $44 million directly siphoned from USMS custody addresses.
“Meet the threat actor John (Lick), who was caught flexing $23M in a wallet address directly tied to $90M+ in suspected thefts from the US Government.”, ZachXBT
Institutional Failure at the Source
The breach highlights a critical vulnerability in the government’s vendor selection process. CMDSS was awarded the USMS contract in 2024 to manage “Class 2-4” cryptocurrencies, assets requiring specialized handling. Competitors like Wave Digital Assets had previously protested the award, citing CMDSS’s lack of regulatory licenses and fiduciary safeguards. Following the revelations, Wave filed a formal complaint with the DOJ Inspector General, describing the theft as a result of “unremedied failures in the USMS procurement process.”
CMDSS has effectively gone dark, deleting its website, LinkedIn, and X accounts. A USMS spokesperson confirmed to reporters that “the matter is under investigation” but offered no further comment on how a contractor’s family member allegedly gained access to federal private keys.
