{"id":93549,"date":"2026-01-26T15:15:16","date_gmt":"2026-01-26T12:15:16","guid":{"rendered":"https:\/\/forklog.com\/en\/?p=93549"},"modified":"2026-01-26T15:20:20","modified_gmt":"2026-01-26T12:20:20","slug":"boasting-on-telegram-leads-to-unveiling-of-40-million-theft-from-us-government","status":"publish","type":"post","link":"https:\/\/u1f987.com\/en\/boasting-on-telegram-leads-to-unveiling-of-40-million-theft-from-us-government\/","title":{"rendered":"Boasting on Telegram Leads to Unveiling of $40 Million Theft from US Government"},"content":{"rendered":"<p>On-chain detective ZachXBT has identified the perpetrator who siphoned off $40 million from a US government wallet. The address was used for storing confiscated funds.<\/p>\n<blockquote class=\"twitter-tweet\">\n<p lang=\"en\" dir=\"ltr\">In case you are curious how John Daghita (Lick) was able to steal $40M+ from US government seizure addresses. <\/p>\n<p>John\u2019s dad owns CMDSS, which currently has an active IT government contract in Virginia. <\/p>\n<p>CMMDS was awarded a contract to assist the USMS in managing\/disposing of\u2026 <a href=\"https:\/\/t.co\/lzR2a1aidA\">https:\/\/t.co\/lzR2a1aidA<\/a> <a href=\"https:\/\/t.co\/PV0IkSuhVy\">pic.twitter.com\/PV0IkSuhVy<\/a><\/p>\n<p>\u2014 ZachXBT (@zachxbt) <a href=\"https:\/\/twitter.com\/zachxbt\/status\/2015430549846777964?ref_src=twsrc%5Etfw\">January 25, 2026<\/a><\/p><\/blockquote>\n<p> <script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p>The culprit was identified as a user with the nickname John \u201cLick\u201d Daghita, the son of Dean Daghita, CEO of <span data-descr=\"Command Services &#038; Support\" class=\"old_tooltip\">CMDSS<\/span>.<\/p>\n<p>In October 2024, this firm <a href=\"https:\/\/www.gao.gov\/products\/b-423217,b-423217.2\">secured a contract<\/a> from the US Marshals Service to manage and dispose of confiscated cryptocurrencies classified as \u201cClass 2-4.\u201d This category includes coins not listed on major centralized exchanges.<\/p>\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" src=\"https:\/\/u1f987.com\/wp-content\/uploads\/img-6849780cf220e578-4645861667260878.webp\" alt=\"image\" class=\"wp-image-274013\"\/><figcaption class=\"wp-element-caption\">John \u201cLick\u201d Daghita. Source: ZachXBT.\u00a0<\/figcaption><\/figure>\n<h2 class=\"wp-block-heading\">Investigation<\/h2>\n<p>ZachXBT&#8217;s attention was drawn to a video recording of a conflict in a Telegram chat. A user named Lick was attempting to prove his financial superiority to opponents.<\/p>\n<p>In the screen recording, the suspect displayed an Exodus wallet, which held approximately $2.3 million on its <a href=\"https:\/\/u1f987.com\/en\/news\/what-is-tron-trx\">TRON<\/a> address. Subsequently, in real time, John Daghita revealed another address on the Ethereum network, transferring $6.7 million to it.<\/p>\n<blockquote class=\"twitter-tweet\" data-conversation=\"none\">\n<p lang=\"en\" dir=\"ltr\">3\/ In part 1 of the recording Dritan mocks John however John screenshares Exodus Wallet which shows the Tron address below with $2.3M:<br \/> TMrWCLMS3ibDbKLcnNYhLggohRuLUSoHJg <a href=\"https:\/\/t.co\/jvcjIVEpaE\">pic.twitter.com\/jvcjIVEpaE<\/a><\/p>\n<p>\u2014 ZachXBT (@zachxbt) <a href=\"https:\/\/twitter.com\/zachxbt\/status\/2014685270868660288?ref_src=twsrc%5Etfw\">January 23, 2026<\/a><\/p><\/blockquote>\n<p> <script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p>By the end of the conflict, one wallet had accumulated $23 million.<\/p>\n<p>The on-chain detective linked these funds to the address 0xc7a2. In March 2024, $24.9 million was transferred to it from a government account holding confiscated Bitfinex assets.<\/p>\n<p>ZachXBT <a href=\"https:\/\/u1f987.com\/en\/news\/speculation-arises-over-20-million-hack-of-us-government-crypto-wallet\">reported<\/a> the theft of approximately $20 million back in October of that year. Most of the funds were returned within a day, but $700,000, withdrawn through exchanges, could not be traced or recovered.<\/p>\n<p>Another address belonging to Lick was linked by the expert to inflows of $63 million from suspected victims and government seizure addresses in the fourth quarter of 2025.<\/p>\n<blockquote class=\"twitter-tweet\" data-conversation=\"none\">\n<p lang=\"en\" dir=\"ltr\">8\/ 0xd8bc is tied to $63M+ inflows from suspected victims and government seizure addresses in Q4 2025. <\/p>\n<p>Dec 2025<br \/>$13.5M <br \/>0x77a722bf33787c3512d0f4fc36412140057f4223<br \/>$15.4M<br \/>0xf51b044f998277b17467cd713d72b403e16fad48<br \/>Nov 2025<br \/>$3M<br \/>TACZPnbg2Fi2ppC3cGxQxZb95SqwAZVAw9<br \/>$1M\u2026 <a href=\"https:\/\/t.co\/3BjyLGXYhP\">pic.twitter.com\/3BjyLGXYhP<\/a><\/p>\n<p>\u2014 ZachXBT (@zachxbt) <a href=\"https:\/\/twitter.com\/zachxbt\/status\/2014685288447009110?ref_src=twsrc%5Etfw\">January 23, 2026<\/a><\/p><\/blockquote>\n<p> <script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<h2 class=\"wp-block-heading\">Fraudster&#8217;s Reaction<\/h2>\n<p>ZachXBT published the Telegram account identifier of the perpetrator, after which he promptly deleted all his <a href=\"https:\/\/u1f987.com\/en\/news\/what-are-nfts\">NFT<\/a> names and changed the display name in his profile.<\/p>\n<p>Later, Daghita sent the on-chain detective $20 in ETH from one of the wallets linked to the theft.<\/p>\n<p>Amid the uproar, the company&#8217;s website, as well as its pages on X and LinkedIn, were deactivated. The subject of the investigation started a Telegram channel.<\/p>\n<blockquote class=\"twitter-tweet\" data-conversation=\"none\">\n<p lang=\"en\" dir=\"ltr\">Update: John Daghita (Lick) began trolling again on Telegram shortly after my post <a href=\"https:\/\/t.co\/iDHX5QpRcE\">pic.twitter.com\/iDHX5QpRcE<\/a><\/p>\n<p>\u2014 ZachXBT (@zachxbt) <a href=\"https:\/\/twitter.com\/zachxbt\/status\/2015450656652603394?ref_src=twsrc%5Etfw\">January 25, 2026<\/a><\/p><\/blockquote>\n<p> <script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p>ZachXBT also shared photos of John Daghita flaunting expensive watches and cars.<\/p>\n<blockquote class=\"twitter-tweet\" data-conversation=\"none\">\n<p lang=\"en\" dir=\"ltr\">Only the son flexes watches \/ cars \/ pj <a href=\"https:\/\/t.co\/TW0HJYbhbn\">pic.twitter.com\/TW0HJYbhbn<\/a><\/p>\n<p>\u2014 ZachXBT (@zachxbt) <a href=\"https:\/\/twitter.com\/zachxbt\/status\/2015437200360681980?ref_src=twsrc%5Etfw\">January 25, 2026<\/a><\/p><\/blockquote>\n<p> <script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p>Back in December, the on-chain detective <a href=\"https:\/\/u1f987.com\/en\/news\/zachxbt-uncovers-2-million-crypto-scammer\">tracked<\/a> a fraudster who stole over $2 million in a year using social engineering techniques.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>On-chain detective ZachXBT has identified the perpetrator who siphoned off $40 million from a US government wallet.<\/p>\n","protected":false},"author":1,"featured_media":93550,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"select":"1","news_style_id":"1","cryptorium_level":"","_short_excerpt_text":"ZachXBT identifies thief of $40 million from US government wallet.","creation_source":"","_metatest_mainpost_news_update":false,"footnotes":""},"categories":[3],"tags":[],"class_list":["post-93549","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news-and-analysis"],"aioseo_notices":[],"amp_enabled":true,"views":"947","promo_type":"1","layout_type":"1","short_excerpt":"ZachXBT identifies thief of $40 million from US government wallet.","is_update":"","_links":{"self":[{"href":"https:\/\/u1f987.com\/en\/wp-json\/wp\/v2\/posts\/93549","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/u1f987.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/u1f987.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/u1f987.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/u1f987.com\/en\/wp-json\/wp\/v2\/comments?post=93549"}],"version-history":[{"count":1,"href":"https:\/\/u1f987.com\/en\/wp-json\/wp\/v2\/posts\/93549\/revisions"}],"predecessor-version":[{"id":93551,"href":"https:\/\/u1f987.com\/en\/wp-json\/wp\/v2\/posts\/93549\/revisions\/93551"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/u1f987.com\/en\/wp-json\/wp\/v2\/media\/93550"}],"wp:attachment":[{"href":"https:\/\/u1f987.com\/en\/wp-json\/wp\/v2\/media?parent=93549"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/u1f987.com\/en\/wp-json\/wp\/v2\/categories?post=93549"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/u1f987.com\/en\/wp-json\/wp\/v2\/tags?post=93549"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}