We’d love your feedback.
Take a 30-second survey to help improve The Block.
Blockchain investigator ZachXBT has alleged that the individual behind a multimillion-dollar theft of cryptocurrency from U.S. government wallets is the son of the head of a company contracted by the U.S. Marshals Service to custody seized digital assets.
According to ZachXBT’s investigation, an individual known online as “Lick,” real name John Daghita, is allegedly involved in siphoning tens of millions of dollars worth of crypto from government wallets. Furthermore, ZachXBT has alleged that Daghita is the son of Dean Daghita, the chief executive of CMDSS, a company holding a government custody contract.
Company records show Dean Daghita serves as president of Command Services & Support (CMDSS), the Haymarket, Virginia-based firm that was awarded a contract by the U.S. Marshals Service in October 2024 to assist with managing and disposing of “Class 2-4” seized cryptocurrencies, which include coins not supported by mainstream centralized exchanges.
The allegations have not been adjudicated in court, and no official charges have been announced. The Block could not reach CMDSS for comment.
The claims build on an investigation ZachXBT published on Jan. 23 that linked an individual known online as “John” or “Lick” to over $90 million in suspected illicit crypto. The investigation traced funds back to a U.S. government wallet tied to assets seized from the 2016 Bitfinex hack.
‘Band-for-band’ dispute exposes wallets
ZachXBT’s original investigation came to light after the alleged threat actor got into a recorded argument with another individual in a Telegram group chat. The dispute, known in cybercrime circles as “band for band,” involved both parties attempting to prove who controlled more cryptocurrency.
During the exchange, “Lick” screen-shared an Exodus wallet showing a Tron address holding approximately $2.3 million. An additional $6.7 million in ether was then transferred live into an Ethereum address. By the end of the exchange, roughly $23 million had been consolidated into one wallet.
Tracing funds backward, ZachXBT linked the wallet to another address that had received $24.9 million from a U.S. government address in March 2024. That government address was tied to funds seized in the Bitfinex hack, which ZachXBT first flagged in October 2024 when approximately $20 million was drained from government-controlled wallets. The majority of those funds were returned within 24 hours, though roughly $700,000 sent through instant exchanges was not recovered.
CMDSS contract faced prior scrutiny
CMDSS’s government contract has previously drawn scrutiny. The firm beat out competitors including Wave Digital Assets for the contract to handle the Marshals Service’s non-mainstream seized crypto. Wave subsequently filed a protest with the Government Accountability Office, alleging that CMDSS lacked proper licensing with the Securities and Exchange Commission and the Financial Industry Regulatory Authority.
Wave also raised concerns about a potential conflict of interest, alleging that the Marshals Service failed to properly investigate CMDSS’s employment of a former USMS official with access to nonpublic information. The GAO denied the protest, finding that the agency’s evaluation was reasonable.
A February 2025 CoinDesk report highlighted broader challenges facing the Marshals Service in managing seized crypto. According to the report, the agency could not provide even a rough estimate of its bitcoin holdings and had previously relied on spreadsheets lacking adequate inventory controls.
