There’s a big pot of digital gold out there.
Over the weekend, ZachXBT, who is an advisor to crypto investment firm Paradigm and has been called “one of the best digital detectives” by The New York Times, claimed that the perpetrator of a suspected $40 million theft from the U.S. government’s crypto holdings is the son of an executive at a firm tasked with the management of those funds. Now, the U.S. Marshals Service says it’s investigating the situation.
Command Services & Support (CMDSS) was awarded a government contract for the management and disposal of a specific class of crypto assets in October 2024. Dean Daghita is the chief executive of CMDSS, and according to ZachXBT, his son, John Daghita (also known as Lick), is connected to a theft of crypto funds in government custody that were associated with the 2016 hack of crypto exchange Bitfinex. According to a report in The Block, most—but not all—of these funds allegedly stolen from the government were returned within 24 hours.
In case you are curious how John Daghita (Lick) was able to steal $40M+ from US government seizure addresses.
John’s dad owns CMDSS, which currently has an active IT government contract in Virginia.
CMMDS was awarded a contract to assist the USMS in managing/disposing of… https://t.co/lzR2a1aidA pic.twitter.com/PV0IkSuhVy
ZachXBT (@zachxbt) January 25, 2026
The connection between John Daghita and the stolen funds is said by crypto insiders to have been made after the accused was seen bragging about large-value crypto wallets in a Telegram group chat. During a dispute with another member of the group chat, where each user was attempting to prove they controlled more crypto than the other, John allegedly revealed access to a wallet connected to the previous theft of funds from government custody.
