FBI and French Authorities Arrest John Daghita in $46 Million Crypto Theft from US Marshals Service
In a stunning international operation, John Daghita, accused of stealing over $46 million in cryptocurrency from wallets managed by the U.S. Marshals Service, was arrested on the Caribbean island of Saint Martin. The joint effort between the FBI and France’s elite Gendarmerie tactical unit marks a significant breakthrough in a case that exposed vulnerabilities in government handling of seized digital assets.[1][2]
High-Stakes Arrest Confirmed by FBI Director
FBI Director Kash Patel announced the arrest on his official X account late Wednesday, sharing images of seized hardware wallets and a briefcase filled with U.S. currency. “Last night, John Daghita – a U.S. government contractor who allegedly stole more than $46 million in cryptocurrency from the U.S. Marshals Service – was arrested on the island of Saint Martin by the French Gendarmerie’s premier elite tactical unit in a joint operation with the FBI,” Patel wrote.[1][2][3][5]
Daghita, who operated online under the aliases “John” or “Lick,” is the son of Dean Daghita, president and CEO of Command Services & Support (CMDSS), a Virginia-based firm with a $4 million contract from the U.S. Marshals Service to manage seized cryptocurrency assets. While authorities have not detailed the exact method of access, investigators believe Daghita exploited insider knowledge or privileges linked to his family’s business.[2][3][4]
The Theft Unraveled by a Social Media Boast
The case traces back to October 2024, when more than $20 million in cryptocurrency—originally seized by the U.S. government following the 2016 Bitfinex hack—was stolen from a government-controlled wallet. Most funds were returned after FBI intervention, but approximately $700,000 evaded recovery, routed through instant exchanges.[1][3]
The breakthrough came in January 2026 during an online “band-for-band” exchange on Telegram, a trend where participants flaunt their crypto holdings. Blockchain investigator ZachXBT spotted Daghita, using the “John/Lick” handle, moving funds traceable to the 2024 theft. One wallet allegedly under his control held 12,540 Ether, worth about $36 million at current prices.[1][2][3]
“The actor behind the ‘John/Lick’ persona began moving funds through mixers and across blockchains in an apparent effort to obscure the origin and ownership of the stolen assets.”
— TRM Labs Blog[1]
ZachXBT’s public exposé prompted Daghita to launder funds aggressively, but on-chain analysis linked the activity directly to him. Estimates suggest total thefts could exceed $90 million when including late 2025 transactions.[3]
Family Ties to Government Contracts
CMDSS’s role in managing “mission-critical” seized assets for the USMS placed the Daghitas at the heart of operations handling billions in crypto. The U.S. Marshals Service oversees vast holdings, estimated at over 198,000 BTC worth tens of billions.[3] Daghita’s now-deleted LinkedIn profile listed him as working for the firm, fueling suspicions of insider exploitation.[4][5]
ZachXBT clarified that John is the son of the contractor, not the primary holder, though Patel referred to him as a contractor himself. The discrepancy highlights ongoing questions about CMDSS’s security protocols, which were protested by a competing firm during contract award.[2][4]
Ongoing Investigation and Broader Implications
Authorities plan forfeiture proceedings to recover remaining assets, with tracing efforts targeting exchanges, bridges, and mixers. Patel emphasized the FBI’s commitment: “FBI will continue working 24/7 with our international partners to track down, apprehend, and bring to justice those who attempt to defraud American taxpayers—no matter where they try to hide.”[5]
This arrest underscores blockchain’s dual nature: a tool for transparency that unravels crimes through public mistakes, like Daghita’s boastful display. It also spotlights risks in government crypto custodianship, amid growing U.S. holdings from seizures.[1][3]
Context in Rising Crypto Crimes
The case echoes recent incidents, such as the January 2026 arrest of two California teens in Arizona for a $66 million crypto-related home invasion. As digital assets proliferate in law enforcement seizures, securing them remains paramount.[5]
Investigators continue probing potential accomplices and full theft scope. Daghita’s extradition and charges are pending, but the operation demonstrates swift global cooperation in crypto enforcement.