On-chain sleuth ZachXBT has revealed the identification of a risk actor who stole over $40 million from the U.S. authorities’s crypto stash. The White Home has confirmed that it’s wanting into the scenario however has not but stated whether or not its Bitcoin holdings had been affected by the theft.
How This Menace Actor Stole Over $40 Million From the U.S. Authorities Crypto Wallets
In an X publish, ZachXBT revealed that risk actor John Daghita, often known as Lick, stole over $40 million from the U.S. authorities’s seizure addresses, as his dad owns Command Providers & Help (CMDSS), which has an energetic IT authorities contract. CMDSS was awarded a contract to help the U.S. Marshals in managing and disposing of seized and forfeited crypto belongings. Nevertheless, the ZachXBT famous that it stays unclear how John obtained entry from his dad.
The CMDSS firm X account, web site, and LinkedIn had been all deactivated following ZachXBT’s revelation. In the meantime, the crypto investigator had first drawn consideration to John in an earlier X publish, stating that the risk actor had been caught flexing $23 million in a pockets handle.
He famous that this pockets was straight tied to over $90 million in suspected thefts from the U.S. Authorities in 2024 and a number of different unidentified victims from November 2025 to December 2025. John revealed this crypto pockets throughout a heated argument with one other risk actor, Dritan Kapplani Jr., in a gaggle chat about who had extra funds of their crypto wallets.
The Supply Of The Funds
Following John’s messages, ZachXBT traced the supply of the risk actor’s funds to a pockets (0xc7a2) that acquired $24.9 million from a U.S. Authorities handle in March 2024 associated to the Bitfinex hack seizure, which was a theft from the federal government. John’s pockets (0xd8bc), which he confirmed off in the course of the heated argument, can also be stated to be tied to $63 million in inflows from suspected victims and government-seizure addresses within the fourth quarter of final yr.
John shortly eliminated the entire NFT usernames from his Telegram account and adjusted his display screen identify after ZachXBT’s publish. In the meantime, it’s price noting that the crypto investigator recognized John as John Daghitia after rumors started circulating that the risk actor was the identical particular person beforehand arrested in September 2025. Nevertheless, it stays unclear for what John was arrested final yr.
Is The U.S. Authorities’s BTC At Threat?
White Home crypto adviser Patrick Witt confirmed in an X publish that they’re investigating the theft and can present an replace quickly. This growth can also be vital, as U.S. President Donald Trump has already signed an govt order that allocates all U.S. authorities Bitcoin holdings to the Strategic BTC Reserve.
Based mostly on the timeline of those thefts from the federal government’s seizure addresses, John appears to be like to have stolen a few of these crypto belongings after Trump signed the manager order. In the meantime, a part of the theft occurred underneath the Biden Administration. There has but to be affirmation from the federal government on how a lot BTC it holds. Nevertheless, BiTBo knowledge reveals that the U.S. authorities at the moment holds 198,012 BTC.
Featured picture from Pixabay, chart from Tradingview.com
Editorial Course of for bitcoinist is centered on delivering completely researched, correct, and unbiased content material. We uphold strict sourcing requirements, and every web page undergoes diligent overview by our workforce of prime expertise specialists and seasoned editors. This course of ensures the integrity, relevance, and worth of our content material for our readers.
