The mystery surrounding millions vanishing from U.S. government-controlled wallets has cracked wide open, not through advanced forensics, but because of a bruised ego.
On-chain investigator ZachXBT has linked a wallet holding over $90 million in illicit funds directly to assets seized by the U.S. government from the 2016 Bitfinex hack. The breakthrough came after a threat actor known as "John" (alias "Lick") inadvertently revealed his wallet addresses while live-streaming a net-worth dispute, a "band-for-band" contest, against a rival hacker.
The $23 Million Mistake
The exposure occurred during a heated Discord exchange where "John" screen-shared his Exodus wallet to prove he controlled more liquidity than his opponent. He displayed approximately $23 million in various assets, including a live transfer of $6.7 million in ETH to a specific address (0xd8bc…).
ZachXBT mapped this "flex" immediately. The analysis revealed:
- The Link: The wallet 0xd8bc was funded by 0xc7a2.
- The Source: 0xc7a2 received $24.9 million directly from a U.S. government seizure wallet in March 2024.
- The Stash: The government wallet in question still holds roughly $18.5 million, raising critical questions about how "John" siphoned nearly $25 million without immediate detection.
"The emerging network… illustrates how tracing illicit crypto funds can gradually uncover relationships between apparently unrelated wallets," ZachXBT noted in the report.
Insider Theory Gains Steam
The breach implies a catastrophic failure in federal asset custody. Reports from Cryptopolitan and other analysts suggest "John" may be John "Lick" Daghita, an individual whose family allegedly holds IT contracts with the U.S. Marshals Service (USMS). If confirmed, this pivots the narrative from an external exploit to an insider job, potentially granting the actor direct access to private keys entrusted to federal agencies.
Market reaction was muted but wary. While the $90 million figure is a fraction of the total Bitfinex recovery, the ease with which seized assets were allegedly co-opted has shaken confidence in government-managed liquidation channels. Traders are now monitoring the identified wallets (0xd8bc and 0xc7a2) for signs of a wash-sale or mixer deposit.
