U.S. marshals investigate claim of $40 million crypto theft by son of federal crypto custodian

The U.S. Marshals Service (USMS) is investigating allegations that the son of a Department of Defense and Department of Justice services provider, charged with managing cryptocurrency seized by law enforcement, stole more than $40 million worth of confiscated digital assets.

Blockchain investigator ZachXBT accused John “Lick” Daghita, son of Dean Daghita, president of CMDSS — a firm that says on its website it provides critical services for the Department of Justice and Department of Defense — of stealing the seized digital assets from crypto walltes managed by his father’s company.

ZachXBT, who said he reported John to authorities, stated it remains unclear how John Daghita allegedly obtained access to the wallets, including whether that access came through his father.

Brady McCarron, chief of public affairs for the USMS, told CoinDesk that the agency could not comment further on this case because investigations were underway.

“Meet the threat actor John (Lick), who was caught flexing $23M in a wallet address directly tied to $90M+ in suspected thefts from the US Government in 2024 and multiple other unidentified victims from Nov 2025 to Dec 2025,” ZachXBT posted on X last Friday.

ZachXBT identified the individual as John Daghita, claiming CMDSS currently holds an active federal IT contract. The blockchain investigator later said he reported a wallet address holding 12,540 ETH, worth roughly $36.3 million, which he said was controlled by Daghita. ZachXBT added that Daghita sent him 0.6767 ETH, which he said he would forward to a U.S. government seizure address.

“In case you are curious how John Daghita (Lick) was able to steal $40 million plus from U.S. government seizure addresses: John’s dad owns CMDSS, which currently has an active IT government contract in Virginia,” ZachXBT wrote, pointing to a CoinDesk report that CMDSS was awarded a contract to assist the U.S. Marshals Service (USMS) in managing and disposing of seized and forfeited crypto assets.

The Department of Defense, ZachXBT, and CMDSS did not immediately respond to a CoinDesk request for comment.

Caught on video

In February 2025, after the White House announced it was considering a national crypto reserve, a source familiar with the matter told CoinDesk the U.S. Marshals Service did not appear to know how much cryptocurrency it held.

The USMS is tasked with managing assets seized by law enforcement during criminal investigations, including real estate, cash, jewelry, antiques and vehicles.

John Daghita drew attention to himself after becoming embroiled in a recorded argument in a Telegram group chat with another individual. The exchange, known in cybercriminal circles as a “band for band,” involved both participants attempting to prove who controlled more cryptocurrency. ZachXBT captured the dispute on video.

“In part 1 of the (video) recording, Dritan (another threat actor) mocks John,” Zach said. “However, John screenshares [a] Exodus Wallet,” showing $2.3 million. In part 2 of the recording, Dritan continued to mock John while another $6.7 million worth of ETH is moved” into a wallet address.

ZachXBT said the full recording shows that Daghita “clearly controls both addresses.” The sleuth then explained he traced the funds to verify their origin, finding that at least $23 million was tied to roughly $90 million in crypto seized by the government in 2024 and 2025.

“Threat actors only continue to showing off stolen funds in leaked recordings rather than simply just staying quiet after an alleged theft from the U.S. government,” criticized Zach, saying they only make it easy for law enforcement to support a case against them.