The US Marshals Service (USMS) is investigating allegations that the son of a Department of Defense and Department of Justice service provider charged with handling cryptocurrency seized by law enforcement stole more than $40 million in confiscated digital assets.
Blockchain investigator ZachXBT has accused John “Lick” Daghita, son of Dean Daghita, president of CMDSS — a company that claims on its website that it provides essential services to the Department of Justice and the Department of Defense — of stealing digital assets seized from crypto wallets run by his father’s company.
ZachXBT, who said he reported John to authorities, said it remains unclear how John Daghita allegedly gained access to the wallets, including whether that access came through his father.
Brady McCarron, head of public affairs for the USMS, told CoinDesk that the agency could not comment further on the matter because investigations were ongoing.
“Meet threat actor John (Lick), who was caught handling $23 million in a wallet address directly linked to over $90 million in alleged thefts from the US government in 2024 and several other unidentified victims from November 2025 to December 2025,” ZachXBT posted on X last Friday.
ZachXBT identified the individual as John Daghita, saying CMDSS currently has an active federal IT contract. The blockchain investigator later said he reported a wallet address containing 12,540 ETH, worth around $36.3 million, which he believed was controlled by Daghita. ZachXBT added that Daghita sent him 0.6767 ETH, which he said he would forward to a US government capture address.
“In case you’re curious how John Daghita (Lick) was able to steal over $40 million from US government seizure addresses: John’s father owns CMDSS, which currently has an active government IT contract in Virginia,” ZachXBT wrote, pointing to a CoinDesk report that CMDSS was awarded a contract to help the US Marshals Service (USMS) manage and dispose of seized and confiscated crypto assets.
The Department of Defense, ZachXBT and CMDSS did not immediately respond to a request for comment from CoinDesk.
Taken on video
In February 2025, after the White House announced it was considering creating a national cryptocurrency reserve, a source familiar with the matter told CoinDesk that the US Marshals Service did not appear to know how much cryptocurrency it held.
The USMS is responsible for managing assets seized by law enforcement during criminal investigations, including real estate, cash, jewelry, antiques and vehicles.
John Daghita drew attention to himself after he was involved in a recorded argument during a Telegram group chat with another individual. The exchange, known in cybercriminal circles as “group for group,” involved both participants attempting to prove who controlled the most cryptocurrency. ZachXBT captured the argument on video.
“In the first part of (video) During the recording, Dritan (another menacing actor) makes fun of John,” Zach said. “However, John shares the screen [a] Exodus Wallet”, showing $2.3 million. In the second part of the recording, Dritan continued to mock John while another $6.7 million worth of ETH is transferred” into a wallet address.
ZachXBT said the full recording shows Daghita “clearly controls both addresses.” The detective then explained that he traced the funds to verify their origin, discovering that at least $23 million was linked to approximately $90 million in crypto seized by the government in 2024 and 2025.
“Bad actors simply continue to show stolen funds in leaked records, rather than simply remaining silent after alleged theft from the U.S. government,” Zach criticized, saying they are only making it easy for law enforcement to support cases against them.
