Major Cryptocurrency Theft from Federal Wallets: Investigation into the Connections of a Contractor's Son from Virginia

The US Marshals Service (USMS) has launched a full-scale investigation into one of the most high-profile digital asset thefts. At the center of the scandal is a cryptocurrency theft exceeding $40 million, extracted from government vaults. The investigation revealed a potential link between the incident and a federal contractor operating out of Virginia, raising serious questions about control over confiscated state digital assets.

ZachXBT Identifies Suspected Thief and His Connections to CMDSS

Blockchain investigator ZachXBT published his analysis, pointing to John Daghita (known as “Lick”) as the individual allegedly responsible for the theft. According to ZachXBT’s investigation, Daghita is the son of Dean Daghita, president of CMDSS, a company providing services to the Department of Defense and the Department of Justice. CMDSS received a federal IT contract to manage confiscated crypto assets and is currently actively collaborating with authorities in Virginia.

This information becomes critically important in the context of the incident. If a relative is directly involved in managing federal assets through their company, it opens a potential vector for unauthorized access to government funds. ZachXBT stated that he has forwarded the information to the relevant law enforcement agencies and continues to track the movement of assets.

Following the Chain: From Government Wallets to Cryptocurrency Accounts

Thorough blockchain analysis allowed ZachXBT to trace the movement of funds, which he estimates are directly linked to approximately $90 million in cryptocurrency confiscated by the government during 2024-2025. The investigator identified at least $23 million transferred to addresses he identified as controlled by Daghita.

The most notable example was a wallet with a balance of 12,540 Ethereum (ETH), worth approximately $36.3 million. ZachXBT claims this wallet is under the control of the suspected culprit and is connected to a chain of other addresses containing stolen funds. Subsequently, according to the researcher, Daghita sent him a small amount of 0.6767 ETH, which he stated he is willing to hand over to the US government confiscation agency.

Video Evidence: How the Thief Bragged About Stolen Funds

The most convincing part of the evidence came from an unexpected source — recordings from a Telegram group where conflicting parties showed each other the amounts of assets they controlled. This method, known in the crypto community as “band for band,” is a kind of competition in bragging about crypto holdings.

In the first part of the video, an opponent with the nickname Dritan mocked Daghita, but the latter responded by opening his Exodus wallet screen and demonstrating crypto assets worth $2.3 million. In the second part, as Dritan continued skeptical remarks, Daghita transferred an additional $6.7 million in Ethereum. ZachXBT concluded that the video clearly demonstrates Daghita’s control over both addresses and confirms his access to significant volumes of digital assets.

The crypto investigator noted the paradoxical situation: criminals usually try to hide their actions, but here the alleged thief was openly showing stolen funds in dialogues, greatly facilitating law enforcement’s evidence collection. The video evidence was recorded and documented for use in the investigation.

Control Issues: Why the Government Doesn’t Know the Exact Amount of Its Cryptocurrency

This incident exposed a deeper issue in managing government digital assets. According to previous reports, the US Marshals Service does not have precise information about the total amount of crypto it controls. This means no one can confidently say how large the problem is or whether other amounts remain undiscovered and stolen.

USMS traditionally manages all types of confiscated property — from real estate and cash to jewelry and vehicles. However, expanding authority to manage cryptocurrency required engaging external contractors like CMDSS, creating additional points of potential risk and unauthorized access.

Federal Contract and System Vulnerabilities in Virginia

CMDSS, led by Dean Daghita, received a federal IT contract to provide services including assisting the US Marshals Service in managing and liquidating confiscated crypto assets. According to ZachXBT, this same company maintains active working relationships with Virginia state authorities.

The structure of such contracts creates a potential conflict of interest, especially when family members of the contractor’s leadership have access to information systems and network infrastructure where digital assets are stored. The question of how John Daghita gained access to federal wallets remains one of the key points in the investigation. Having a father in a leadership position at the contractor company significantly facilitates such access, either through direct provision or by using the father’s credentials.

US Marshals Service Position

Brady McCarron, the US Marshals Service Public Affairs Chief, confirmed an active investigation but declined to provide any additional comments. According to McCarron, details of the case cannot be disclosed as the investigation is still in its early stages. The Department of Defense and CMDSS itself also refused to comment on the investigation requests.

This incident again highlights the need to review the control and oversight system over government cryptocurrency, especially considering the administration’s plans to create a national crypto reserve, which will require managing even larger volumes of digital assets.