Arrest in the Caribbean: The story behind the theft from a U.S. Government crypto wallet

In early 2026, details emerged about one of the most unusual cases in the cryptocurrency world. A suspect had allegedly managed to steal digital assets from U.S. authorities—funds that had previously been confiscated from criminal organizations. GetBlock AML Research revealed new details about the high-profile investigation.

Key Points

• In October 2024, more than $20 million was stolen from a cryptocurrency wallet controlled by the U.S. government. After the FBI launched an investigation, most of the funds were recovered, though part of the stolen assets remains missing.
• In January 2026, during an unusual online exchange known in crypto communities as “band-for-band”—where participants publicly show their crypto balances—independent blockchain investigator ZachXBT noticed a participant using the aliases “John” or “Lick.” The user appeared to be moving funds connected to the earlier theft from the government wallet.
• After his activity was publicly linked to the incident, the individual behind the “John/Lick” aliases began rapidly moving funds through services designed to obscure transaction trails and across multiple blockchain networks, apparently attempting to hide the origin and ownership of the stolen assets.
• On March 5, 2026, John Daghita was arrested on the Caribbean island of Saint Martin. The arrest aligns with earlier findings by ZachXBT, who had linked Daghita to cryptocurrency wallets involved in moving the stolen funds.

Arrest in the Caribbean

John Daghita, accused of stealing tens of millions of dollars in cryptocurrency from wallets associated with the U.S. Marshals Service, was arrested on the island of Saint Martin during a joint operation conducted by the FBI and the French Gendarmerie.

JohnDaghita

The arrest was publicly confirmed by FBI Director Kash Patel, who posted images from the operation on the social media platform X. The photos show several hardware cryptocurrency wallets—devices used to securely store digital assets—as well as a briefcase containing U.S. cash.

$\mathrm{<img\; src="https://storage.getblock.net/source/1/qbDQzRb7tUyDthW2gRDhAIcUiy-BGFTj.jpg"><a\; title="Source:\; X.com"\; href="https://x.com/FBIWFO/status/2029678454694642051"\; class="copyright"\; target="\_blank">Source:\; X.com</a>}$

The investigation has become one of the most unusual cryptocurrency theft cases in recent years. It involves an individual who allegedly had connections to a company responsible for helping store confiscated digital assets on behalf of the U.S. government.

The case also demonstrates how blockchain transparency, independent online investigations, and international law-enforcement cooperation can expose even complex attempts to conceal stolen crypto.

How the Investigation Began

The story gained widespread attention in January 2026, when blockchain investigator ZachXBT published the results of his analysis. He identified links between a user operating under the aliases “John” or “Lick” and a network of cryptocurrency wallets controlling large sums of suspicious funds.

Scandal of the year: confiscated U.S. crypto ends up in private hands

The identity of a suspect who gained access to government wallets holding confiscated cryptocurrency and allegedly stole the funds has been revealed

Читать дальше

According to his findings, these wallets may have controlled more than $90 million in cryptocurrency. Among those funds were assets traced back to wallets controlled by the U.S. government. About $24.9 million originated from a government wallet that held cryptocurrency previously confiscated during the 2016 Bitfinex hack investigation.

Those seized assets were part of a broader pool of cryptocurrency that could potentially contribute to a U.S. strategic Bitcoin reserve, referenced in a March 2025 presidential executive order on digital assets.

During the investigation, ZachXBT also noted rumors circulating within crypto communities. According to those rumors, the person controlling the suspicious wallets might be John Daghita, the son of Dean Daghita, president of Command Services & Support (CMDSS).

CMDSS, a Virginia-based company, received a contract from the U.S. Marshals Service in October 2024 to assist with the storage and management of certain categories of seized cryptocurrency. At the time the investigation was published, no official charges had been filed against John Daghita. However, his later arrest appears to support the link between him and the wallets under investigation.

The Telegram “Band-for-Band” Exchange

The investigation began with an unusual public moment. On January 23, 2025, members of a private Telegram group held a “band-for-band” exchange. In these exchanges, participants try to prove their wealth by displaying the balances of their cryptocurrency wallets or even transferring funds during the conversation.

During the exchange, a user operating under the alias “Lick” displayed his Exodus cryptocurrency wallet on screen. One address on the TRON network held roughly $2.3 million.

Other transactions were also observed in real time. For example, approximately $6.7 million worth of Ether was transferred to another address on the Ethereum network, also controlled by the same user.

By the end of the exchange, about $23 million had been consolidated into a single wallet. Because the transfers occurred live and were shown on screen, ZachXBT was able to capture the exact wallet addresses, transaction data, and fund flows as they happened. This provided unusually strong evidence linking the Telegram user to specific cryptocurrency wallets.

Tracking the Stolen Funds

After identifying the wallets involved in the Telegram exchange, the investigator began analyzing their transaction history. Blockchain analysis made it possible to trace the funds backward in time and connect them to the March 2024 theft from the U.S. government wallet.

Once the investigation was published, the funds began moving rapidly. They were transferred across multiple blockchain networks, passed through crypto mixing services designed to obscure transaction trails, and routed through other tools intended to hide their origin.

After becoming aware of the report, the FBI began monitoring these movements. Investigators were able to identify addresses where the funds were recombined after passing through mixing services, as well as potential points where the stolen cryptocurrency may have been converted into cash.

Details of Daghita’s Arrest

The investigation ultimately led to the arrest of John Daghita on the Caribbean island of Saint Martin. The operation was carried out by French gendarmerie special units in coordination with the FBI.

The case highlights the increasingly international nature of cryptocurrency investigations. Digital assets can move across borders almost instantly, but cooperation between law-enforcement agencies around the world is also becoming more effective.

After the arrest, investigators released photos showing a briefcase filled with U.S. cash and several hardware cryptocurrency wallets. Such devices are commonly used to store large amounts of cryptocurrency offline and can serve as important evidence linking suspects to specific blockchain addresses.

Blockchain as Evidence

This case highlights a key aspect of cryptocurrency investigations. Even when criminals attempt to hide their tracks using mixing services, cross-chain transfers, or complex transaction chains, blockchain records remain permanently accessible.

How to track cryptocurrency addresses: a complete guide

We reveal the main methods of analyzing cryptocurrency addresses when investigating the movement of assets

Читать дальше

Law-enforcement agencies increasingly rely on blockchain analytics to trace stolen cryptocurrency through exchanges, transaction-mixing services, and other financial tools. These techniques have already helped recover funds in numerous cases—from ransomware attacks to major cryptocurrency exchange hacks.