The US Marshals Service (USMS) is investigating allegations that the son of a Department of Defense and Justice Department service provider charged with managing cryptocurrency seized by law enforcement stole more than $40 million in confiscated digital assets.
Blockchain investigator ZachXBT accused John “Lick” Daghita, son of Dean Daghita, president of CMDSS — a company that says on its website it provides critical services to the Department of Justice and the Department of Defense — of stealing the seized digital assets from crypto wallets managed by his father’s company.
ZachXBT, who said he reported John to authorities, stated that it remains unclear how John Daghita allegedly gained access to the wallets, including whether the access came through his father.
Brady McCarron, director of public affairs for the USMS, told CoinDesk that the agency could not comment further on this matter because investigations were ongoing.
“Meet threat actor John (Lick) who was caught spending $23M in a wallet address directly linked to $90M+ in suspected thefts from the US government in 2024 and several other unidentified victims from November 2025 to December 2025,” ZachXBT wrote on X last Friday.
ZachXBT identified the person as John Daghita and claimed that CMDSS currently has an active federal IT contract. The blockchain investigator later said he reported a wallet address with 12,540 ETH worth about $36.3 million, which he said was controlled by Daghita. ZachXBT added that Daghita sent him 0.6767 ETH, which he said he would forward to a US government seizure address.
“If you’re curious how John Daghita (Lick) was able to steal $40 million plus from US government seizure addresses: John’s father owns CMDSS, which currently has an active IT government contract in Virginia,” ZachXBT wrote, pointing to a CoinDesk report that CMDSS was awarded a contract to assist the US Marshals Service (USMS for seizure and disposal of seized and disposed of assets).
The Department of Defense, ZachXBT and CMDSS did not immediately respond to a CoinDesk request for comment.
Caught on video
In February 2025, after the White House announced it was considering a national crypto reserve, a source familiar with the matter told CoinDesk that the US Marshals Service did not appear to know how much cryptocurrency it held.
The USMS is tasked with managing assets seized by law enforcement officers during criminal investigations, including real estate, cash, jewelry, antiques, and vehicles.
John Daghita drew attention to himself after getting involved in a recorded argument in a Telegram group chat with another person. The exchange, known in cybercriminal circles as a “band by band,” involved both participants trying to prove who controlled more cryptocurrency. ZachXBT caught the dispute on video.
“In Part 1 of (video) recording, Dritan (another threat actor) taunts John,” Zach said. “But John shares screenshots [a] Exodus Wallet,” shows $2.3 million. In part 2 of the recording, Dritan continued to taunt John while another $6.7 million ETH has been moved” into a wallet address.
ZachXBT said the full recording shows Daghita “clearly controls both addresses.” The executive then explained that he traced the funds to confirm their origin and found that at least $23 million was tied to about $90 million in crypto seized by the government in 2024 and 2025.
“Threat actors continue to only show off stolen funds in leaked footage instead of simply keeping quiet after an alleged theft from the US government,” Zach criticized, saying they only make it easier for law enforcement to support a case against them.
